An issue was discovered on Wavlink WL-WN579G3 - M79X3.V5030.180719 and WL-WN575A3 - RPT75A3.V4300.180801 devices, affecting a backup feature. A crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-10974
• https://github.com/Roni-Carta/nyra
• https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974
• https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974-affected_devices
• https://github.com/sudo-jtcsec/Nyra