CVE-2020-10973
HIGH NUCLEIWavlink WN530HG4, WN531G3, WN533A8, and WN551K1 - Unauthenticated Configuration Export via ExportAllSettings.sh
Title source: llmExploitation Summary
CVE-2020-10973 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.
Nuclei Templates (1)
WAVLINK - Access Control
HIGHVERIFIEDby arafatansari
Shodan:
http.html:"Wavlink" || http.html:"wavlink"
FOFA:
body="wavlink"
References (4)
Core 4
Core References
Third Party Advisory x_refsource_misc
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973
Broken Link x_refsource_misc
https://github.com/sudo-jtcsec/Nyra
Not Applicable, Third Party Advisory x_refsource_misc
https://github.com/Roni-Carta/nyra
Third Party Advisory x_refsource_misc
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973-affected_devices
Scores
CVSS v3
7.5
EPSS
0.0776
EPSS Percentile
93.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-306
Status
published
Products (4)
wavlink/wn530hg4_firmware
m30hg4.v5030.191116
wavlink/wn531g3_firmware
wavlink/wn533a8_firmware
wavlink/wn551k1_firmware
Published
May 07, 2020
Tracked Since
Feb 18, 2026