CVE-2020-37097

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file. Attackers can access the script to retrieve sensitive information including WiFi network name and plaintext password stored in device configuration variables.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
EDIMAX Technology Co., Ltd.	EW-7438RPn Mini	1.13

References

https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/Product
https://www.exploit-db.com/exploits/48365Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/edimax-ew-rpn-information-disclosure-wifi-passwordBroken Link

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-370987.8Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with el CVE-2020-370997.8Disk Savvy Enterprise 12.3.18 contains an unquoted service path vulnerability in its service configuration that allows local attackers to po CVE-2020-37107.8Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code CVE-2020-371007.8Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with el CVE-2020-371017.8VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the servi CVE-2020-371027.8Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to pote CVE-2020-371035.4DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executab CVE-2020-371047.5ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by pred CVE-2020-371057.1PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrar CVE-2020-371065.3Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles witho CVE-2020-371077.5Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field w CVE-2020-371087.1PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to m