Design/Logic Flaw

Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfojson.cgi URI...

CVE-2019-16340

Belkin Linksys Velop devices running version 1.1.8.192419 expose a sensitive detail: the recovery key can be obtained by an unauthenticated remote attacker via a direct request to /sysinfo_json.cgi. This CVE (CVE-2019-16340) is documented across multiple sources with the same description, confirm...

CVE-2019-16340: Direct Request

Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfojson.cgi URI...