A remote attacker can use the global API request wrapper function in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal models WES100, WES270, WES280, and WES290 to read sensitive information that should be protected. This vulnerability is classified as CWE-200, which involves inappropriate restricted data access allowing an attacker to discover data without proper authorization. The potential impact includes exposure of confidential configuration, user data, or broadcast content, compromising confidentiality and potentially assisting further attacks on the system.

The affected products are the Wellav WES Emergency Broadcast Terminal lines WES100, WES270, WES280, and WES290. Versions released before 08-08-2023 contain the flaw; newer releases post‑08-08-2023 are presumed patched.

The CVSS score is 7.5, indicating a high severity level. EPSS is not available, so current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the API request wrapper can be invoked over the network. No additional prerequisites are stated, so a remote attacker who can reach the API endpoint can exploit the issue without further foothold.