high7.5
CVE-2025-57430
Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get.
Impact
Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Creacast | Creabox Manager | Version 4.4.4 |