Improper input validation in Wavlink Wl-wn530hg4
CVE-2020-10971
An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. The POST request itself is n…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.027 (83.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Wavlink Wl-wn530hg4
- Wavlink Wl-wn530hg4_firmware — versions m30hg4.v5030.191116
- Wavlink Wl-wn575a3
- Wavlink Wl-wn575a3_firmware — versions rpt75a3.v4300.180801
- Wavlink Wl-wn579g3
- Wavlink Wl-wn579g3_firmware — versions m79x3.v5030.180719
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-10971?
- CVE-2020-10971 is a high-severity vulnerability in Wavlink Wl-wn530hg4, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2020-05-07.
- How severe is CVE-2020-10971?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2020-10971 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.