.. / CVE-2020-10973

Exploit for WAVLINK - Access Control (CVE-2020-10973)

Description:

Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.

Nuclei Template

View the template here CVE-2020-10973.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-10973.yaml
Copy

References:

https://github.com/sudo-jtcsec/Nyra
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973-affected_devices
https://nvd.nist.gov/vuln/detail/CVE-2020-10973
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973
https://github.com/Roni-Carta/nyra