ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2020-10974

—
CVSS 3.1
7.5 high
EPSS
2%p76
Published
()
Modified
Description

An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000

Vendors
wavlink
Products
wl-wn575a3 firmware, wl-wn579g3 firmware, wn531a6 firmware, wn535g3 firmware, wn530h4 firmware, wn57x93 firmware, wn572hg3 firmware, wn575a4 firmware, wn578a2 firmware, wn579g3 firmware, wn579x3 firmware, jetstream ac3000 firmware
Weakness
CWE-306
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news

No ingested article mentions this CVE yet.