CVE-2020-10972

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

WAVLINK WN531G3 安全漏洞

The WAVLINK WN531G3 is a wireless router from China's RuiYin Technology WAVLINK. The WAVLINK WN531G3 M31G3.V5030.201204 version and M31G3.V5030.200325 version contain an access control error vulnerability that can be exploited by an attacker to download configuration data and log files...

WAVLINK WN531G3 跨站请求伪造漏洞

The WAVLINK WN531G3 is a wireless router from China-based RuiYin Technology WAVLINK. A security vulnerability exists in WAVLINK WN531G3 firmware version M31G3.V5030.200325 and prior versions, which stems from the non-use of anti-CSRF tokens, and when used in conjunction with other issues such as...

CVE-2020-10972

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

CVE-2020-10972

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

Authentication flaw

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

CVE-2020-10972

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

CVE-2020-10972

CVE-2020-10972 describes an information-disclosure flaw where an unauthenticated page exposes the current administrator password in cleartext within the page source (live_?.shtml with the variable syspasswd). Affected devices include Wavlink WN530HG4, WN531G3, and WN572HG3. Public sources in the ...

PT-2020-12458

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN551K1 Wavlink WL-WN530HG4 version M30HG4.V5030.191116 Description An issue was discovered affecting the /cgi-bin/ExportAllSettings.sh endpoint, where a crafted POST request can return...

CVE-2020-10973: Missing Authentication for Critical Function

An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacke...

CVE-2020-10972: Missing Authentication for Critical Function

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page a certain live?.shtml page with the variable syspasswd. Affected Devices: Wavlink WN530HG4, Wavlink...

PT-2020-12457

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN531G3 Wavlink WN572HG3 Description An issue was discovered where a page, specifically a certain live ?.shtml page with the variable syspasswd, is exposed and contains the current administrator password in cleartext i...

PT-2020-12456

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN575A3 Wavlink WN579G3 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN531A6 Wavlink WN551K1 Wavlink WN535G3 Wavlink WN530H4 Wavlink WN57X93 WN572HG3 Wavlink WN578A2 Wavlink WN579G3 Wavlink WN579X3 Jetstream AC3000/ERAC3000...

PT-2020-13084

Name of the Vulnerable Software and Affected Versions Wavlink WN530HG4 Wavlink WN575A3 Wavlink WN579G3 Wavlink WN531G3 Wavlink WN533A8 Wavlink WN531A6 Wavlink WN551K1 Wavlink WN535G3 Wavlink WN530H4 Wavlink WN57X93 WN572HG3 Wavlink WN578A2 Wavlink WN579G3 Wavlink WN579X3 Jetstream AC3000/ERAC3000...

CVE-2020-12266: Missing Authentication for Critical Function

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...