CVE-2020-10974: Wavlink Jetstream AC3000 Firmware

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000

Affected products

• Wavlink Jetstream AC3000 Firmware: affected versions not specified
• Wavlink Jetstream ERAC3000 Firmware: affected versions not specified
• Wavlink Wl-WN575A3 Firmware: version rpt75a3.v4300.180801 only
• Wavlink Wl-WN579G3 Firmware: version m79x3.v5030.180719 only
• Wavlink WN530H4 Firmware: affected versions not specified
• Wavlink WN531A6 Firmware: affected versions not specified
• Wavlink WN535G3 Firmware: affected versions not specified
• Wavlink WN572HG3 Firmware: affected versions not specified
• Wavlink WN575A4 Firmware: affected versions not specified
• Wavlink WN578A2 Firmware: affected versions not specified
• Wavlink WN579G3 Firmware: affected versions not specified
• Wavlink WN579X3 Firmware: affected versions not specified
• Wavlink WN57X93 Firmware: affected versions not specified

Published 2020-05-07. Last modified 2026-06-17.