What’s Vulnerable › Vulnerabilities

CVE-2021-4471: TG8 Firewall Unauthenticated User Password Disclosure

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-14 · updated 2026-06-17
• Weakness: CWE-538

Description

TG8 Firewall exposes a directory such as /data/ over HTTP without authentication. This directory stores credential files for previously logged-in users. A remote unauthenticated attacker can enumerate and download files within the directory to obtain valid account usernames and passwords, leading to loss of confidentiality and further unauthorized access.

Affected products

• TG8 Firewall: 0

References

• https://ssd-disclosure.com/ssd-advisory-tg8-firewall-preauth-rce-and-password-disclosure/
• https://web.archive.org/web/20211024224240/http://www.tg8security.com/
• https://www.vulncheck.com/advisories/tg8-firewall-unauthenticated-user-password-disclosure
• https://ssd-disclosure.com/ssd-advisory-tg8-firewall-preauth-rce-and-password-disclosure/

Get alerted when CVE-2021-4471 or the next vulnerability affects your stack