Wavlink Multiple AP - Remote Command Injection

Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the "key" parameter in a login request. It has been tested on Wavlink...

CVE-2020-13117

Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request...

CVE-2020-13117

creationtimestamp| type| source ---|---|--- 2025-01-07 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-07 2025-01-21 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-21 2025-01-24 00:00:00+00:00| seen| The Shadowserver...

VulnCheck KEV: CVE-2020-13117

Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request...

CVE-2020-13117

Vulnerability summary (CVE-2020-13117) : Wavlink WN575A4 and WN579X3 devices (and WN530G3A per CVE scope) are affected by an unauthenticated remote command-injection vulnerability in the login API that uses the key parameter. The connected nuclei template confirms remote command execution, tested...