CVE-2022-4985

The record

Vodafone H500s devices running firmware v3.5.10 (hardware model Sercomm VFH500) expose the WiFi access point password via an unauthenticated HTTP endpoint. By sending a crafted GET request to /data/activation.json with specific headers and cookies, a remote attacker can retrieve a JSON document that contains the wifi_password field. This allows an unauthenticated attacker to obtain the WiFi credentials and gain unauthorized access to the wireless network, compromising confidentiality of network traffic and attached systems.

Affected packages

Related vulnerabilities

• CVE-2026-76968 SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an… CWE-497
• CVE-2026-80119 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and… CWE-497
• CVE-2026-80118 PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and… CWE-497
• CVE-2026-66840 XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized… CWE-497
• CVE-2026-67267 Dell Command Update (DCU), versions prior to 5.7.1, contain an Exposure of Sensitive… CWE-497
• CVE-2026-74007 Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook… CWE-497
• CVE-2026-32468 Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions. CWE-497
• CVE-2026-66462 Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions. CWE-497