BIT-KIBANA-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

BIT-ELK-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

Huawei E5331 Info Disclosure

Module exploits information disclosure vulnerability in Huawei E5331 MiFi Mobile Hotspotdevices. If the target is vulnerable it allows to read sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei E5331 Info Disclosure""" import re from kittysploit import from...

Zyxel Eir D1000 WiFi Password Disclosure

Module exploits WiFi Password Disclosure vulnerability in Zyxel/Eir D1000 devices. If the target is vulnerable it allows to read WiFi password. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Eir D1000 WiFi Password Disclosure""" import re from kittysploit import from...

D-Link DWR-932 Info Disclosure

Module explois information disclosure vulnerability in D-Link DWR-932 devices. It is possible to retrieve sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR-932 Info Disclosure""" import json import re from kittysploit import from...

Huawei HG520 Information Disclosure

Module exploits Huawei EchoLife HG520 information disclosure vulnerablity. If the target is vulnerable it is possible to retrieve sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG520 Information Disclosure""" import re from kittysploit import from...

3Com IMC Info Disclosure

Exploits 3Com Intelligent Management Center information disclosure vulnerability that allows to fetch credentials for SQL sa account !/usr/bin/env python3 -- coding: utf-8 -- """3Com IMC Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

3Com OfficeConnect Info Disclosure

Exploits 3Com OfficeConnect information disclosure vulnerability. If the target is vulnerable it is possible to read sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """3Com OfficeConnect Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient impor...

ZTE ZXHN H108N Wifi Password Disclosure

Module exploits ZTE ZXHN H108N WiFi Password Disclosure vulnerability that allows to retrieve password for wifi connection. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE ZXHN H108N Wifi Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Comtrend CT 5361T Password Disclosure

WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Comtrend CT 5361T Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info =...

Cisco DPC2420 Info Disclosure

Module exploits Cisco DPC2420 information disclosure vulnerability which allows reading sensitive information from the configuration file. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco DPC2420 Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

Belkin G & N150 Password Disclosure

Module exploits Belkin G and N150 Password MD5 Disclosure vulnerability which allows fetching administration's password in md5 format !/usr/bin/env python3 -- coding: utf-8 -- """Belkin G & N150 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

Belkin G Info Disclosure

Module exploits Belkin Wireless G Plus MIMO Router F5D9230-4 information disclosure vulnerability which allows fetching sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin G Info Disclosure""" import re from kittysploit import from...

Huawei HG866 Password Change

Module exploits password change vulnerability in Huawei HG866 devices. If the target is vulnerable it allows to change administration password. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG866 Password Change""" import re from kittysploit import from lib.protocols.http.httpclient import...

Cisco UCM Info Disclosure

Module exploits information disclosure vulnerability in Cisco UCM devices. If the target is vulnerable it is possible to read sensitive information through TFTP service. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco UCM Info Disclosure""" import re from kittysploit import from...

SIEMENS IP-Camera CCMS2025 Password Disclosure

Module exploits SIEMENS IP-Camera CCMS2025 Password Dislosure vulnerability. If target is vulnerable it is possible to read administrative credentials !/usr/bin/env python3 -- coding: utf-8 -- """SIEMENS IP-Camera CCMS2025 Password Disclosure""" import re from kittysploit import from...

Asmax AR1004G Password Disclosure

Exploits Asmax AR1004G Password Disclosure vulnerability that allows to fetch credentials for: Admin, Support and User accounts. !/usr/bin/env python3 -- coding: utf-8 -- """Asmax AR1004G Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

DVR Creds Disclosure

Module exploits authentication bypass vulnerability in multiple DVR devices allowing attacker to retrieve users credentials. !/usr/bin/env python3 -- coding: utf-8 -- """DVR Creds Disclosure""" import json import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Mikrotik WinBox Auth Bypass - Creds Disclosure

Module bypass authentication through WinBox service in Mikrotik devices versions from 6.29 release date: 2015/28/05 to 6.42 release date 2018/04/20 and retrieves administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Mikrotik WinBox Auth Bypass - Creds Disclosure""" import re fr...

D-Link DWL-3200AP Password Disclosure

Exploits D-Link DWL3200 access points weak cookie value. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWL-3200AP Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link DWL-3200A...