WAVLINK WL-WN579G3/WL-WN575A3/WL-WN530HG4 Wireless Network live_(string).shtml improper authentication

Summaryinfo

A vulnerability was found in WAVLINK WL-WN579G3, WL-WN575A3 and WL-WN530HG4. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file live_(string).shtml of the component Wireless Network. The manipulation results in improper authentication. This vulnerability is known as CVE-2020-12266. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in WAVLINK WL-WN579G3, WL-WN575A3 and WL-WN530HG4 (version now known). Affected is some unknown processing of the file live_(string).shtml of the component Wireless Network. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on WAVLINK WL-WN579G3 M79X3.V5030.180719, WL-WN575A3 RPT75A3.V4300.180801, and WL-WN530HG4 M30HG4.V5030.191116 devices. There are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed externally without any authentication. All the pages follow the naming convention live_(string).shtml. Among the information disclosed is: interface status logs, IP address of the device, MAC address of the device, model and current firmware version, location, all running processes, all interfaces and their statuses, all current DHCP leases and the associated hostnames, all other wireless networks in range of the router, memory statistics, and components of the configuration of the device such as enabled features.

The weakness was published 04/27/2020. This vulnerability is traded as CVE-2020-12266 since 04/26/2020. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• WAVLINK

Name

• WL-WN530HG4
• WL-WN575A3
• WL-WN579G3

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion