The vulnerability exists in the adInfo() endpoint of FOGProject’s web interface. Before the 1.5.10.1870 release the endpoint returns a JSON field named domainpass that contains the FOG_AD_DEFAULT_PASSWORD constant. Because this endpoint can be invoked with node=ipxe without any authenticated session, an attacker who can reach the FOG server can obtain the default password used for joining machines to Active Directory. This exposes sensitive credential material that could be leveraged for domain join operations or other privileged actions. The weakness is categorized as information disclosure (CWE-200).

Any installation of FOGProject fogproject running a version earlier than 1.5.10.1870 is affected. Those systems remain vulnerable until upgraded to the fixed release. No other vendors were identified by the CNA, so the impact is limited to the fogproject product.

The CVSS base score of 7.5 indicates a high likelihood of exploitation and significant impact. EPSS data is not available, so the probability of real-world exploitation is uncertain, but the vulnerability can be abused by anyone with network reach to the server. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known large-scale exploitation in the wild. A likely attack scenario involves sending an unauthenticated HTTP request to the adInfo endpoint with the node=ipxe parameter, parsing the returned JSON, and capturing the default domain password. If the repository is publicly exposed, an attacker could enumerate multiple machines and collect credentials in bulk.