Wavlink WN575A4 Firmware vulnerabilities

2 CVEs affecting Wavlink WN575A4 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-13117, published 2021-02-09.

More from Wavlink.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-13117, published 2021-02-09. Critical severity, CVSS 9.8. EPSS: 68.6% chance of exploitation in the next 30 days. Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request.
• CVE-2020-10974, published 2020-05-07. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication…