PT-2020-12459 · Wavlink+1 · Wavlink Wn572Hp3+9

Published 2020-05-07 · Updated 2022-04-28 · CVE-2020-10974

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wavlink WN575A3 Wavlink WN579G3 Wavlink WN531A6 Wavlink WN535G3 Wavlink WN530H4 Wavlink WN57X93 Wavlink WN572HG3 Wavlink WN575A4 Wavlink WN578A2 Wavlink WN579X3 Jetstream AC3000/ERAC3000

Description An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required.

Recommendations For Wavlink WN575A3, consider disabling the backup feature until a patch is available. For Wavlink WN579G3, restrict access to the backup feature to minimize the risk of exploitation. For Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579X3, and Jetstream AC3000/ERAC3000, avoid using the backup feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-10974

Affected Products

Jetstream Ac3000/Erac3000

Wavlink Wn530H4

Wavlink Wn531A6

Wavlink Wn535G3

Wavlink Wn572Hp3

Wavlink Wn575A3

Wavlink Wn575A4

Wavlink Wn578A2

Wavlink Wn579X3

Wavlink Wn57X93

References · 8

• 🔥 https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974-affected_devices · Exploit
• 🔥 https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974 · Exploit
• https://osv.dev/vulnerability/CVE-2020-10974 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10974 · Security Note
• https://t.me/cvenotify/3630 · Telegram Post
• https://t.me/cybersecuritytechnologies/2200 · Telegram Post
• https://github.com/Roni-Carta/nyra · Note
• ❌ https://github.com/sudo-jtcsec/Nyra · Note, Deleted