high7.5
CVE-2020-10974
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the adm…
Impact
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wavlink | Wl-Wn575a3 Firmware | Version rpt75a3.v4300.180801 |
| Wavlink | Wl-Wn579g3 Firmware | Version m79x3.v5030.180719 |
| Wavlink | Wn531a6 Firmware | All versions |
| Wavlink | Wn535g3 Firmware | All versions |
| Wavlink | Wn530h4 Firmware | All versions |
| Wavlink | Wn57x93 Firmware | All versions |
| Wavlink | Wn572hg3 Firmware | All versions |
| Wavlink | Wn575a4 Firmware | All versions |
| Wavlink | Wn578a2 Firmware | All versions |
| Wavlink | Wn579g3 Firmware | All versions |
| Wavlink | Wn579x3 Firmware | All versions |
| Wavlink | Jetstream Ac3000 Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Roni-Carta/nyra
- https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974
- https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974-affected_devices
- https://github.com/sudo-jtcsec/Nyra
- https://github.com/Roni-Carta/nyra
- https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974
- https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974-affected_devices
- https://github.com/sudo-jtcsec/Nyra