Web server vulnerabilities

An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do not expose credentials or provide administrative functionality, but may include non-public device content, such as screen-saver content or assets used by the web interface.

Due to webserver misconfiguration, an unauthenticated remote attacker is able to read the source of PHP modules.

A denial-of-service security issue exists in the affected product and version, stemming from a high number of requests sent to the web server. This can cause a web server crash but does not impact I/O control or communication; a power cycle is required to recover the webpage.