CVE-2020-10973
HIGH NUCLEIWavlink - Info Disclosure
Title source: llmDescription
An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.
Nuclei Templates (1)
WAVLINK - Access Control
HIGHVERIFIEDby arafatansari
Shodan:
http.html:"Wavlink" || http.html:"wavlink"
FOFA:
body="wavlink"
Scores
CVSS v3
7.5
EPSS
0.2483
EPSS Percentile
96.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-306
Status
published
Products (4)
wavlink/wn530hg4_firmware
m30hg4.v5030.191116
wavlink/wn531g3_firmware
wavlink/wn533a8_firmware
wavlink/wn551k1_firmware
Published
May 07, 2020
Tracked Since
Feb 18, 2026