ID: HIGH-02

Title: Sensitive credentials exposed in plaintext in config flash partition

Severity: High

CVSS Score: 7.5

CVSS Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description: Static analysis of the config flash partition (0xFA0000 - 0xFF0000), extracted from firmware publicly available on the vendor’s website, revealed sensitive data stored in plaintext including the Wi-Fi SSIDs, WPS PIN, Wi-Fi PSK, and the MD5 hash of the web interface administrator password. This data is directly readable from the firmware binary without requiring any decryption, meaning an attacker can recover network credentials without physical access to a device.

Remediation: Encrypt sensitive configuration data stored in flash memory using device-unique keys. Avoid storing credential hashes alongside plaintext network credentials in the same partition.

More information: See Manual Firmware Analysis chapter.