CVE-2023-5499

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in the 'log2' directory. An attacker could retrieve sensitive information such as remembered wifi networks, sent messages, SOS device locations and device configurations.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-55008.8This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain CVE-2023-55025.9On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access CVE-2023-55048.7The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This CVE-2023-55056.8The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the job-specific backup f CVE-2023-55064.3The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area CVE-2023-55075.4The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including,CVE-2023-55095.4The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the act CVE-2023-55118.8Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3.CVE-2023-55125.7An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, CVE-2023-55145.3The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumer CVE-2023-55155.3The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal st CVE-2023-55165.3Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information