Wavlink WN531G3 Firmware vulnerabilities

6 CVEs affecting Wavlink WN531G3 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-40623, published 2022-09-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-10973, published 2020-05-07. High severity, CVSS 7.5. EPSS: 7.6% chance of exploitation in the next 30 days. An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current…
CVE-2020-10972, published 2020-05-07. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a…
CVE-2020-12266, published 2020-04-27. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically…
CVE-2022-40621, published 2022-09-13. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a…
CVE-2022-40622, published 2022-09-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP…
CVE-2022-40623, published 2022-09-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such as CVE-2022-35518), can lead to remote,…