A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access administrative information-retrieval functions intended for authenticated users. By invoking "get_*" operations, attackers can obtain device configuration data, including plaintext credentials, without authentication or an existing session.
Project Subscriptions
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Feb 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Shenzhen Zhibotong Electronics
Shenzhen Zhibotong Electronics zbt We2001 |
|
| Vendors & Products |
Shenzhen Zhibotong Electronics
Shenzhen Zhibotong Electronics zbt We2001 |
Wed, 11 Feb 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access administrative information-retrieval functions intended for authenticated users. By invoking "get_*" operations, attackers can obtain device configuration data, including plaintext credentials, without authentication or an existing session. | |
| References |
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-02-11T16:38:00.657Z
Reserved: 2025-11-18T00:00:00.000Z
Link: CVE-2025-65127
No data.
Status : Awaiting Analysis
Published: 2026-02-11T17:16:07.710
Modified: 2026-02-11T18:06:04.010
Link: CVE-2025-65127
No data.
OpenCVE Enrichment
Updated: 2026-02-11T21:46:19Z
Weaknesses
No weakness.