CVE-2022-34048

Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting XSS vulnerability via the loginpage parameter...

Cross site scripting

Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting XSS vulnerability via the loginpage parameter...

Design/Logic Flaw

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...

CVE-2022-34046

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...

CVE-2022-34046

The CVE-2022-34046 issue affects WAVLINK WN533A8 (M33A8.V5030.190716). It is an improper access control vulnerability enabling an attacker to retrieve usernames and passwords by inspecting view-source:http:///sysinit.shtml?r=52300 and spotting logincheck(user);. Impact could include unauthorized ...

CVE-2022-34048

Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting XSS vulnerability via the loginpage parameter...

CVE-2022-34048

CVE-2022-34048 affects Wavlink WN533A8 (M33A8.V5030.190716). The issue is a reflected cross-site scripting (XSS) vulnerability exploitable via the login_page parameter in the device’s login page. Attack impact, as described in connected sources, could allow an attacker to execute arbitrary script...

PT-2022-21983 · Wavlink · Wavlink Wn533A8

Name of the Vulnerable Software and Affected Versions: Wavlink WN533A8 version M33A8.V5030.190716 Description: An access control issue allows attackers to obtain usernames and passwords via the API endpoint "http://IP ADDRESS/sysinit.shtml?r=52300" by searching for logincheckuser. Recommendations...

PT-2022-21985

Name of the Vulnerable Software and Affected Versions Wavlink WN533A8 version M33A8.V5030.190716 Description A reflected cross-site scripting XSS issue was found, which can be exploited via the login page parameter. This allows an attacker to inject malicious scripts into the website, potentially...

CVE-2022-34046: Incorrect Authorization

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser;...

CVE-2022-34048: Improper Neutralization of Input During Web Page Generation

Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting XSS vulnerability via the loginpage parameter...

CVE-2020-10973

WAVLINK WN530HG4 / WN531G3 / WN533A8 / WN551K1 are affected by an improper access control vulnerability in /cgi-bin/ExportAllSettings.sh. A crafted POST request, without authentication, returns the device’s current configuration including the administrator password; the attacker must perform a de...

CVE-2020-10973: Missing Authentication for Critical Function

An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacke...

PT-2020-12456

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN575A3 Wavlink WN579G3 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN531A6 Wavlink WN551K1 Wavlink WN535G3 Wavlink WN530H4 Wavlink WN57X93 WN572HG3 Wavlink WN578A2 Wavlink WN579G3 Wavlink WN579X3 Jetstream AC3000/ERAC3000...

PT-2020-12458

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN551K1 Wavlink WL-WN530HG4 version M30HG4.V5030.191116 Description An issue was discovered affecting the /cgi-bin/ExportAllSettings.sh endpoint, where a crafted POST request can return...

PT-2020-13084

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN575A3 Wavlink WN579G3 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN531A6 Wavlink WN551K1 Wavlink WN535G3 Wavlink WN530H4 Wavlink WN57X93 WN572HG3 Wavlink WN578A2 Wavlink WN579G3 Wavlink WN579X3 Jetstream AC3000/ERAC3000...

CVE-2020-12266: Missing Authentication for Critical Function

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...