High severity · published May 7, 2020
CVE-2020-10972
An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink WN530HG4, Wavlink WN531G3, and Wavlink WN572HG3
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wn530hg4 Firmware · Wavlink
m30hg4.v5030.191116 · source: NVD
WF
Wn531g3 Firmware · Wavlink
All versions, or not specified · source: NVD
WF
Wn572hg3 Firmware · Wavlink
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10972
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10972
Not Applicable
https://github.com/Roni-Carta/nyra
Third Party Advisory
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10972
Third Party Advisory
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10972-affected_devices
Broken Link
https://github.com/sudo-jtcsec/Nyra
More from Wn530hg4 Firmware
8.8
CVE-2024-10194
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028
7.5
CVE-2020-10973
An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the…
7.2
CVE-2024-10429
A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028
7.2
CVE-2024-10428
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028
7.2
CVE-2024-10193
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical