wavlink Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/wavlink/ Sun, 26 Feb 2023 06:37:51 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png wavlink Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/wavlink/ 32 32 CVE-2020-15490 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15490/ Sun, 26 Feb 2023 06:37:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15490/ An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities exist in CGI scripts, leading to remote code execution with root privileges. (The set of affected scripts is similar to CVE-2020-12266.)

The post CVE-2020-15490 appeared first on CVE Vulnerability.

]]> An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities exist in CGI scripts, leading to remote code execution with root privileges. (The set of affected scripts is similar to CVE-2020-12266.)

The post CVE-2020-15490 appeared first on CVE Vulnerability.

]]> CVE-2020-15489 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15489/ Sun, 26 Feb 2023 06:37:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15489/ An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vulnerabilities exist in CGI scripts, leading to remote code execution with root privileges.

The post CVE-2020-15489 appeared first on CVE Vulnerability.

]]> An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vulnerabilities exist in CGI scripts, leading to remote code execution with root privileges.

The post CVE-2020-15489 appeared first on CVE Vulnerability.

]]> CVE-2020-13117 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-13117/ Sun, 26 Feb 2023 06:36:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-13117/ Wavlink WN575A4 and WN579X3 devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request.

The post CVE-2020-13117 appeared first on CVE Vulnerability.

]]> Wavlink WN575A4 and WN579X3 devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request.

The post CVE-2020-13117 appeared first on CVE Vulnerability.

]]> CVE-2020-12266 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-12266/ Sun, 26 Feb 2023 06:36:31 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-12266/ An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed externally without any authentication. All the pages follow the naming convention […]

The post CVE-2020-12266 appeared first on CVE Vulnerability.

]]> An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed externally without any authentication. All the pages follow the naming convention live_(string).shtml. Among the information disclosed is: interface status logs, IP address of the device, MAC address of the device, model and current firmware version, location, all running processes, all interfaces and their statuses, all current DHCP leases and the associated hostnames, all other wireless networks in range of the router, memory statistics, and components of the configuration of the device such as enabled features. Affected devices: Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000

The post CVE-2020-12266 appeared first on CVE Vulnerability.

]]> CVE-2020-12127 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-12127/ Sun, 26 Feb 2023 06:36:30 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-12127/ An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.

The post CVE-2020-12127 appeared first on CVE Vulnerability.

]]> An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.

The post CVE-2020-12127 appeared first on CVE Vulnerability.

]]> CVE-2020-12126 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-12126/ Sun, 26 Feb 2023 06:36:30 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-12126/ Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak router settings, change configuration variables, and cause denial of service via an unauthenticated endpoint.

The post CVE-2020-12126 appeared first on CVE Vulnerability.

]]> Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak router settings, change configuration variables, and cause denial of service via an unauthenticated endpoint.

The post CVE-2020-12126 appeared first on CVE Vulnerability.

]]> CVE-2020-10971 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10971/ Sun, 26 Feb 2023 06:36:01 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10971/ An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. The POST request itself is not validated to ensure it came from the active session. Affected devices […]

The post CVE-2020-10971 appeared first on CVE Vulnerability.

]]> An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. The POST request itself is not validated to ensure it came from the active session. Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000

The post CVE-2020-10971 appeared first on CVE Vulnerability.

]]> CVE-2020-10972 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10972/ Sun, 26 Feb 2023 06:36:01 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10972/ An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink WN530HG4, Wavlink WN531G3, and Wavlink WN572HG3

The post CVE-2020-10972 appeared first on CVE Vulnerability.

]]> An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink WN530HG4, Wavlink WN531G3, and Wavlink WN572HG3

The post CVE-2020-10972 appeared first on CVE Vulnerability.

]]> CVE-2020-10973 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10973/ Sun, 26 Feb 2023 06:36:01 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10973/ An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.

The post CVE-2020-10973 appeared first on CVE Vulnerability.

]]> An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.

The post CVE-2020-10973 appeared first on CVE Vulnerability.

]]> CVE-2020-10974 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10974/ Sun, 26 Feb 2023 06:36:01 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10974/ An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and […]

The post CVE-2020-10974 appeared first on CVE Vulnerability.

]]> An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000

The post CVE-2020-10974 appeared first on CVE Vulnerability.

]]>