Unauthenticated GET requests to the MobileManager getConfiguration endpoint in WWBN AVideo versions up to 30.0 expose sensitive backend configuration data. The JSON response reveals TLS private key file paths, socket settings, platform version, and debug flags. Because no authentication is required, attackers can retrieve details that could aid in credential compromise or system exploitation. This constitutes an information disclosure vulnerability classified under CWE‑200.

All installations of WWBN AVideo up through version 30.0 that also have the MobileManager plugin enabled are impacted. No operating system or deployment environment constraints were disclosed, suggesting the flaw exists in every instance where the plugin is deployed. The vulnerability is triggered by accessing the plugin/MobileManager/getConfiguration.json.php URL on the web server hosting the application.

The assigned CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available, so we cannot quantify exploitation probability. The flaw can be exploited simply by sending an unauthenticated GET request to the endpoint. Although it is not listed in the CISA KEV catalog, the leakage of TLS key paths and debug switches could help attackers plan more destructive actions. Environments exposing the endpoint to external networks pose the highest risk.