CVE-2024-33470

The AVTECH Room Alert 4E version v4.4.0 is vulnerable to a passback attack within its SMTP Email Settings. When an administrator authenticates and browses the settings pages, the SMTP password is loaded from the device and displayed in the DOM in plaintext . Additionally, SMTP credentials are tra...

PT-2024-25276 · Avtech · Avtech Room Alert 4E

Name of the Vulnerable Software and Affected Versions: AVTECH Room Alert 4E version 4.4.0 Description: An issue in the Sensor Settings allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request to an unspecified API endpoint. This issue only affects products that...

CVE-2024-33470: Cleartext Storage of Sensitive Information

An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2024-33471: Cleartext Storage of Sensitive Information

An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...