CVE-2025-57433

The 2wcom IP-4c audio codec device (version 2.15.5 ) contains an information disclosure vulnerability within its web interface. An authenticated attacker, including one with low-privileged guest access , can send a crafted POST request to the /cwi/ajax_request/get_data.php endpoint to retrieve th...

CVE-2025-57438

The 2wcom IP-4c audio codec device (version 2.15.5 ) is vulnerable to a Broken Access Control flaw. While sensitive endpoints are designed to require explicit admin-level authorization for manager-level accounts, a manager-level user can bypass these restrictions by intercepting and modifying req...