CVE-2025-43988

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials.

Published 2025-08-13. Last modified 2026-06-17.