Wavlink WN551K1 Firmware vulnerabilities

7 CVEs affecting Wavlink WN551K1 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-38897, published 2024-06-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-10973, published 2020-05-07. High severity, CVSS 7.5. EPSS: 7.6% chance of exploitation in the next 30 days. An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current…
CVE-2020-12266, published 2020-04-27. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically…
CVE-2024-38894, published 2024-06-24. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi.
CVE-2024-38896, published 2024-06-24. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi.
CVE-2024-38897, published 2024-06-24. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.
CVE-2024-38895, published 2024-06-24. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.
CVE-2024-38892, published 2024-06-24. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.