This vulnerability involves the exposure of sensitive management credentials stored in the localStorage of the LWEB802 browser component in Loytec LWEB-802 products prior to version 5.0.8. An unauthenticated remote attacker can exploit this by crafting a malicious link that causes the leakage of these credentials. The vulnerability is identified as CWE-200 and has a CVSS 4.0 base score of 7.7, indicating a high severity. No official patch or remediation level has been published as of the data available.

An unauthenticated remote attacker can leak sensitive management credentials from the affected LWEB-802 device, potentially leading to unauthorized access or control. The exposure of these credentials compromises the confidentiality of the system's management interface. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been published, users should monitor Loytec's advisories for updates. Until a fix is available, avoid clicking on untrusted links that could exploit this vulnerability and consider restricting access to the management interface to trusted networks or users.