Medium severity · published Jun 30, 2023
CVE-2023-32620
Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
WL-WN531AX2 · WAVLINK TECHNOLOGY Ltd.
firmware versions prior to 2023526 · source: vendor
WF
Wl-wn531ax2 Firmware · Wavlink
before 2023526 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-32620
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-32620
Patch
https://jvn.jp/en/jp/JVN78634340/
Patch
https://www.wavlink.com/en_us/firmware/details/932108ffc5.html
More from WL-WN531AX2
8.1
CVE-2023-32613
Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally…
7.2
CVE-2023-32622
Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the…
7.2
CVE-2023-32621
WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege
7.2
CVE-2023-32612
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to…