PT-2020-13053 · Wavlink · Wavlink Wn530H4

Published 2020-10-02 · Updated 2021-07-21 · CVE-2020-12127

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 M30H4.V5030.190403

Description The issue allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication through the "API Endpoint: /cgi-bin/ExportAllSettings.sh".

Recommendations For WAVLINK WN530H4 M30H4.V5030.190403, as a temporary workaround, consider restricting access to the /cgi-bin/ExportAllSettings.sh endpoint until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-12127

Affected Products

Wavlink Wn530H4

References · 4

• https://osv.dev/vulnerability/CVE-2020-12127 · Vendor Advisory
• https://wavlink.com/en_us/product/WL-WN530H4.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12127 · Security Note
• https://cerne.xyz/bugs/CVE-2020-12127 · Note