Information Disclosure in WAVLINK Router Settings
CVE-2020-12127

7.5HIGH

Key Information:

Vendor

Wavlink

Status
Wn530h4 Firmware
Vendor
CVE Published:
2 October 2020

What is CVE-2020-12127?

An information disclosure vulnerability exists in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403. This flaw allows unauthorized attackers to access and extract sensitive router configurations, including cleartext login credentials and DNS settings, posing a significant risk to users' security and privacy. Proper measures should be taken to mitigate potential exposure through this endpoint.

References

https://www.wavlink.com/en_us/product/WL-WN530H4.html
x_refsource_MISC
https://cerne.xyz/bugs/CVE-2020-12127
x_refsource_MISC

EPSS Score

30% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-12127 : Information Disclosure in WAVLINK Router Settings