Vulnerability Description
An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wavlink | Wn530Hg4 Firmware | m30hg4.v5030.191116 |
| Wavlink | Wn530Hg4 | - |
| Wavlink | Wn531G3 Firmware | - |
| Wavlink | Wn531G3 | - |
| Wavlink | Wn533A8 Firmware | - |
| Wavlink | Wn533A8 | - |
| Wavlink | Wn551K1 Firmware | - |
| Wavlink | Wn551K1 | - |
Related Weaknesses (CWE)
References
- https://github.com/Roni-Carta/nyraNot ApplicableThird Party Advisory
- https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973Third Party Advisory
- https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973-affected_devicesThird Party Advisory
- https://github.com/sudo-jtcsec/NyraBroken Link
- https://github.com/Roni-Carta/nyraNot ApplicableThird Party Advisory
- https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973Third Party Advisory
- https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973-affected_devicesThird Party Advisory
- https://github.com/sudo-jtcsec/NyraBroken Link
FAQ
What is CVE-2020-10973?
CVE-2020-10973 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuratio...
How severe is CVE-2020-10973?
CVE-2020-10973 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10973?
Check the references section above for vendor advisories and patch information. Affected products include: Wavlink Wn530Hg4 Firmware, Wavlink Wn530Hg4, Wavlink Wn531G3 Firmware, Wavlink Wn531G3, Wavlink Wn533A8 Firmware.