CVE-2024-25735: WyreStorm Apollo VX20 exposes cleartext passwords via config endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.1 with no authentication or user interaction required and public exploit material available, though KEV listing is absent.

What it is

WyreStorm Apollo VX20 devices before firmware 1.3.58 expose cleartext passwords through a SoftAP /device/config GET request. The credentials are returned without encryption or authentication, so anyone who can reach the endpoint can read them. This matters because recovered passwords can unlock the device and any reused credentials elsewhere.

Impact

An attacker obtains cleartext device passwords, enabling unauthorized access to the device and potential lateral movement if credentials are reused. The CVSS vector also rates high integrity impact, though the description only documents credential disclosure.

Attack surface

Reachable over the network via an HTTP GET to /device/config on the SoftAP interface; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.50622 (98.9th percentile) and references include an Exploit-tagged Packet Storm entry, indicating public exploit material exists.

What to do

• Upgrade Apollo VX20 firmware to 1.3.58 or later.
• Disable or restrict the SoftAP interface where operationally possible.
• Change any passwords exposed by the endpoint and avoid credential reuse across devices.
• Segment device management interfaces from untrusted networks and block external access to /device/config.

Detection

• Monitor network traffic for GET requests to /device/config on Apollo VX20 devices.
• Alert on access to the SoftAP management interface from unexpected source addresses.
• Review device and authentication logs for logins using credentials that may have been exposed.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.