Vulnerabilities > Wavlink
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-10-02 | CVE-2020-12125 | Classic Buffer Overflow vulnerability in Wavlink Wn530H4 Firmware M30H4.V5030.190403 A remote buffer overflow vulnerability in the /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary machine instructions as root without authentication. | 10.0 |
| 2020-10-02 | CVE-2020-12124 | OS Command Injection vulnerability in Wavlink Wn530H4 Firmware M30H4.V5030.190403 A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication. | 10.0 |
| 2020-10-02 | CVE-2020-12123 | Cross-Site Request Forgery (CSRF) vulnerability in Wavlink Wn530H4 Firmware M30H4.V5030.190403 CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoints, because these endpoints do not contain CSRF tokens. | 7.8 |
| 2020-07-01 | CVE-2020-15490 | Classic Buffer Overflow vulnerability in Wavlink Wl-Wn530Hg4 Firmware M30Hg4.V5030.191116 An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. | 10.0 |
| 2020-07-01 | CVE-2020-15489 | Injection vulnerability in Wavlink Wl-Wn530Hg4 Firmware M30Hg4.V5030.191116 An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. | 10.0 |
| 2020-05-07 | CVE-2020-10974 | Missing Authentication for Critical Function vulnerability in Wavlink products An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. | 5.0 |
| 2020-05-07 | CVE-2020-10973 | Missing Authentication for Critical Function vulnerability in Wavlink products An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. | 5.0 |
| 2020-05-07 | CVE-2020-10972 | Insufficiently Protected Credentials vulnerability in Wavlink products An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. | 5.0 |
| 2020-05-07 | CVE-2020-10971 | Improper Input Validation vulnerability in Wavlink products An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. | 9.3 |
| 2020-04-27 | CVE-2020-12266 | Missing Authentication for Critical Function vulnerability in Wavlink products An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. | 5.0 |