CVE-2020-10974: wavlink jetstream_ac3000_firmware
Vulnerability summary
CVE-2020-10974 is a high (CVSS 7.5) vulnerability in wavlink jetstream_ac3000_firmware. EPSS estimates a 1.69% chance of exploitation in the next 30 days, higher than 76.8% of scored vulnerabilities.
Timeline
- 07-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.69%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.69% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wavlink13 products
- jetstream_ac3000_firmwarena
- jetstream_erac3000_firmwarena
- wl-wn575a3_firmwarerpt75a3.v4300.180801
- wl-wn579g3_firmwarem79x3.v5030.180719
- wn530h4_firmwarena
1 vendor · 13 products
References
4 links- github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974-affected_devicesX Refsource MISCThird Party Advisory