7.5

CVE-2020-10972

An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink WN530HG4, Wavlink WN531G3, and Wavlink WN572HG3
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wavlink ≫ Wn530hg4 Firmware Version m30hg4.v5030.191116
   Wavlink ≫ Wn530hg4 Version -
Wavlink ≫ Wn531g3 Firmware Version -
   Wavlink ≫ Wn531g3 Version -
Wavlink ≫ Wn572hg3 Firmware Version -
   Wavlink ≫ Wn572hg3 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.73% 0.746
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://github.com/Roni-Carta/nyra
Third Party Advisory
Not Applicable
https://github.com/sudo-jtcsec/Nyra
Broken Link
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10972
Third Party Advisory
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10972-affected_devices
Third Party Advisory