CVE-2021-28937

CVE-2021-28937 describes a critical plaintext password disclosure vulnerability in the Acexy Wireless-N WiFi Repeater REV 1.0. The device's web management interface, specifically the /password.html page, exposes the administrator's password unencrypted over HTTP, affecting both the repeater and its firmware. This vulnerability carries a high CVSS score of 7.5 due to its network-based attack vector and low complexity, allowing an unauthenticated attacker to easily obtain sensitive credentials, leading to full device compromise. While there is no evidence of active exploitation or Metasploit modules, Nuclei templates exist for detecting this flaw, and despite its high FAUCET risk score, it has garnered minimal community discussion or media coverage.