CVE-2020-10974 Information disclosure in n/a
Unauthenticated attackers can retrieve the device configuration, including the administrator password, via a crafted POST request to the backup feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10974?
CVE-2020-10974 is a high-severity vulnerability in n/a, published on 7 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
Weakness: CWE-306
Which versions are affected by CVE-2020-10974?
It affects 13 products.
Products include Wavlink Jetstream Ac3000 Firmware, Wavlink Jetstream Erac3000 Firmware, Wavlink Wl-Wn575a3 Firmware, Wavlink Wl-Wn579g3 Firmware, Wavlink Wn530h4 Firmware, Wavlink Wn531a6 Firmware and 7 more.
How do I fix CVE-2020-10974?
No fix has been published for CVE-2020-10974 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10974 being exploited?
There is no known exploitation of CVE-2020-10974 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-wp3x-cvf7-rqrm.