HIGH🇵🇱 Wersja polska

CVE-2020-10974

CVSS 7.5v3.1pub. 2020-05-07upd. 2024-11-21

An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Wavlink Jetstream Ac3000

    HW
    Wavlink
    all versions

  • Wavlink Jetstream Ac3000 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Jetstream Erac3000

    HW
    Wavlink
    all versions

  • Wavlink Jetstream Erac3000 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wl Wn575a3

    HW
    Wavlink
    all versions

  • Wavlink Wl Wn575a3 Firmware

    OS
    Wavlink
    rpt75a3.v4300.180801

  • Wavlink Wl Wn579g3

    HW
    Wavlink
    all versions

  • Wavlink Wl Wn579g3 Firmware

    OS
    Wavlink
    m79x3.v5030.180719

  • Wavlink Wn530h4

    HW
    Wavlink
    all versions

  • Wavlink Wn530h4 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wn531a6

    HW
    Wavlink
    all versions

  • Wavlink Wn531a6 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wn535g3

    HW
    Wavlink
    all versions

  • Wavlink Wn535g3 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wn572hg3

    HW
    Wavlink
    all versions

  • Wavlink Wn572hg3 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wn575a4

    HW
    Wavlink
    all versions

  • Wavlink Wn575a4 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wn578a2

    HW
    Wavlink
    all versions

  • Wavlink Wn578a2 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wn579g3

    HW
    Wavlink
    all versions

  • Wavlink Wn579g3 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wn579x3

    HW
    Wavlink
    all versions

  • Wavlink Wn579x3 Firmware

    OS
    Wavlink
    all versions

  • Wavlink Wn57x93

    HW
    Wavlink
    all versions

  • Wavlink Wn57x93 Firmware

    OS
    Wavlink
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-38861CRITICAL9.8PL ✓same product

RCE w routerze Wavlink WL-WN575A3 poprzez parametr username w adm.cgi

CVE-2022-37149CRITICAL9.8PL ✓same product

Command injection w routerze WAVLINK WL-WN575A3 przez parametr username

CVE-2022-35519CRITICAL9.8PL ✓same product

Command injection w WAVLINK routerach przez parametr add_mac w firewall.cgi

CVE-2022-35518CRITICAL9.8PL ✓same product

Command injection w WAVLINK nas.cgi — brak filtrowania parametrów User1Passwd i User1

CVE-2022-35520CRITICAL9.8PL ✓same product

Command injection w routerach WAVLINK poprzez ukryty parametr ufconf