Vulnerability · Published Nov 14, 2025 · Assigned by VulnCheck
CVE-2022-4985Vodafone H500s WiFi Password Disclosure via activation.json
High 8.7
In plain English
A high-severity security flaw in Vodafone H500s from Vodacom. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
Vodafone H500s devices running firmware v3.5.10 (hardware model Sercomm VFH500) expose the WiFi access point password via an unauthenticated HTTP endpoint. By sending a crafted GET request to /data/activation.json with specific headers and cookies, a remote attacker can retrieve a JSON document that contains the wifi_password field. This allows an unauthenticated attacker to obtain the WiFi credentials and gain unauthorized access to the wireless network, compromising confidentiality of network traffic and attached systems.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Vodacom | Vodafone H500s | 0 – through 3.5.10 |
Weakness: CWE-497 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://www.exploit-db.com/exploits/50636 exploit
- https://cxsecurity.com/issue/WLB-2022010024 exploit
- https://help.vodacom.co.za/personal/home/61/9493/1023659/Vodafone-H500s-WiFi-router product
- https://www.vulncheck.com/advisories/vodafone-h500s-wifi-password-disclosure-via-activation-json third-party-advisory