This vulnerability exists in eWON Firmware versions 12.2 through 13.0 and allows an attacker with minimal privileges to bypass authentication. By sending a POST request to /wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter, an attacker can retrieve encrypted passwords for all users. The passwords can then be decrypted using a hardcoded XOR key, resulting in credential compromise. The weakness is a credential management flaw identified as CWE-798.

The affected product is eWON firmware from the vendor eWON, specifically versions 12.2 to 13.0.

The vulnerability has a CVSS score of 8.7, indicating high severity, but its EPSS score is below 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers need network access to the device and can exploit the vulnerability remotely by crafting requests to the vulnerable endpoint, thereby extracting sensitive credential data.