A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access administrative information-retrieval functions intended for authenticated users. By invoking "get_*" operations, attackers can obtain device configuration data, including plaintext credentials, without authentication or an existing session.
History

Wed, 11 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Shenzhen Zhibotong Electronics
Shenzhen Zhibotong Electronics zbt We2001
Vendors & Products Shenzhen Zhibotong Electronics
Shenzhen Zhibotong Electronics zbt We2001

Wed, 11 Feb 2026 17:00:00 +0000

Type Values Removed Values Added
Description A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access administrative information-retrieval functions intended for authenticated users. By invoking "get_*" operations, attackers can obtain device configuration data, including plaintext credentials, without authentication or an existing session.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-02-11T16:38:00.657Z

Reserved: 2025-11-18T00:00:00.000Z

Link: CVE-2025-65127

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-02-11T17:16:07.710

Modified: 2026-02-11T18:06:04.010

Link: CVE-2025-65127

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-02-11T21:46:19Z