CVE-2021-28937

HighCVSS 7.5

Published: 29/03/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

4.12%

90th percentile - higher than 90% of all known CVEs

Summary

The /password.html page of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) web management interface exposes the administrator password in plaintext. The page can be intercepted over HTTP.

Risk Assessment

Attackers can intercept the administrator password, gaining full control over the device and network.

Recommendation

Immediately update the repeater firmware to a version that does not expose the password in plaintext, and configure HTTPS encryption for the management interface.

Other vulnerabilities in Acexy Wireless-N WiFi Repeater

CVE-2021-28936High
The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) web management allows changing the administrator password via a crafted HTTP GET request without prior authentication, only requiring knowledge of the default username (admin).

Original NVD description (English source)

The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) contains the administrator account password in plaintext. The page can be intercepted on HTTP.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS