An unauthenticated information disclosure vulnerability in the KuWFi 5G01-X55 router allows remote attackers to compromise administrative credentials and system configuration data.

The device exposes an unauthenticated API endpoint at ajax_get.cgi, which permits any unauthenticated remote attacker to retrieve sensitive configuration data from the device.

The exposure of administrative credentials poses a critical risk to network security, as it grants attackers full control over the affected router. With a CVSS score of 7.5, this high severity vulnerability could lead to unauthorized network access, interception of traffic, and further exploitation of connected internal resources, resulting in significant reputational and operational damage.

Immediate Action: Since a patch is currently unknown, immediately restrict access to the device management interface by ensuring it is not exposed to the public internet.

Proactive Monitoring: Review device access logs for unusual requests directed at the ajax_get.cgi endpoint, which may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall or network access control list to block traffic from untrusted sources to the management port of the router.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the research write-up referenced in the CVE record.

Given the high impact of credential theft, administrators must prioritize isolating affected KuWFi devices from external network exposure. Until the vendor provides a firmware update to secure the vulnerable API endpoint, the risk remains elevated, and strict perimeter controls are the only effective method to prevent unauthorized access.