Vulnerability · Published May 7, 2020 · Assigned by mitre

CVE-2020-10971

High 8.8

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)2.7%top 13.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. The POST request itself is not validated to ensure it came from the active session. Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10971 x_refsource_MISC
https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10971-Affected_Devices x_refsource_MISC
https://github.com/sudo-jtcsec/Nyra x_refsource_MISC
https://github.com/Roni-Carta/nyra x_refsource_MISC