PT-2020-13049 · Wavlink · Wavlink Wn530H4

Published 2020-10-02 · Updated 2020-10-08 · CVE-2020-12123

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 M30H4.V5030.190403

Description The issue allows an attacker to remotely access router endpoints due to the lack of CSRF tokens in the /cgi-bin/ directory. This can be exploited if a user is authenticated in the router portal.

Recommendations For WAVLINK WN530H4 M30H4.V5030.190403, consider restricting access to the /cgi-bin/ directory until a patch is available. As a temporary workaround, avoid using the router portal when connected to untrusted networks to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-12123

Affected Products

Wavlink Wn530H4

References · 4

• https://wavlink.com/en_us/product/WL-WN530H4.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12123 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12123 · Vendor Advisory
• https://cerne.xyz/bugs/CVE-2020-12123 · Note