This vulnerability involves the exposure of sensitive information due to improper handling of management credentials stored in the localStorage of the LWEB802 browser component in Loytec LWEB-802 products prior to version 5.0.8. An unauthenticated remote attacker can exploit this by crafting a specific link that causes the leakage of these credentials. The issue is classified under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack traceability, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can leak sensitive management credentials stored in the browser localStorage, potentially leading to unauthorized access or control over the affected device. This compromises confidentiality and could facilitate further attacks or unauthorized management actions on the Loytec LWEB-802 device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor Loytec's advisories for updates. Until a fix is available, avoid clicking on untrusted links that could exploit this vulnerability and consider restricting access to the management interface to trusted networks or users.