CVE-2020-12106

Name of the Vulnerable Software and Affected Versions VPNCrypt M10 version 2.6.5

Description The issue concerns the Web portal of the WiFi module, which allows unauthenticated users to send HTTP POST requests to critical administrative functions. This includes changing credentials of the Administrator account or connecting the product to a rogue access point.

Recommendations For VPNCrypt M10 version 2.6.5, consider restricting access to the Web portal of the WiFi module to prevent unauthenticated users from sending HTTP POST requests to administrative functions until a patch is available. As a temporary workaround, limit the ability to change Administrator account credentials and prevent connections to unknown access points.