CVE-2020-12127

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to leak router settings, including cleartext login details, DNS settings, and other sensitive information without authentication.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cerne.xyz/bugs/CVE-2020-12127Third Party Advisory
https://www.wavlink.com/en_us/product/WL-WN530H4.htmlProduct, Vendor Advisory
https://cerne.xyz/bugs/CVE-2020-12127Third Party Advisory
https://www.wavlink.com/en_us/product/WL-WN530H4.htmlProduct, Vendor Advisory

Timeline

Published: Oct 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-121287.5DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.CVE-2020-121296.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function.CVE-2020-12137.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut CVE-2020-121306.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.CVE-2020-121316.1The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).CVE-2020-121326.1Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.CVE-2020-121339.8The Apros Evolution, ConsciusMap, and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewSta CVE-2020-121349.8Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log.CVE-2020-121355.5bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_sp CVE-2020-121376.1GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS CVE-2020-121388.8AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of several driver routine CVE-2020-12147.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut