Wavlink WN579X3 Firmware vulnerabilities

5 CVEs affecting Wavlink WN579X3 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-3380, published 2023-06-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-13117, published 2021-02-09. Critical severity, CVSS 9.8. EPSS: 68.6% chance of exploitation in the next 30 days. Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request.
CVE-2022-31847, published 2022-06-14. High severity, CVSS 7.5. EPSS: 6.6% chance of exploitation in the next 30 days. A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.
CVE-2023-3380, published 2023-06-23. Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of…
CVE-2020-12266, published 2020-04-27. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically…
CVE-2020-10974, published 2020-05-07. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication…