All posts

A new home for research notes, reverse engineering, and language-model experiments.

Multiple authentication bypass flaws in the /cgi-bin/ endpoint of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) let an unauthenticated attacker leak router settings, change configuration variables, and cause denial of service.

The /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) disclosed router settings, including cleartext login details and DNS settings, without authentication.

The /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) allowed an unauthenticated remote attacker to execute arbitrary Linux commands as root via command-line injection.

The /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) had a remote buffer overflow that let an unauthenticated attacker execute arbitrary machine instructions as root.

The /cgi-bin/ endpoints of the WAVLINK WN530H4 (firmware M30H4.V5030.190403) lacked CSRF tokens, so an attacker could reach router functions through a user authenticated in the router portal.

On the Juplink RX4-1500 running firmware v1.0.3, an attacker on the local network who can authenticate as admin could gain root access to the Linux subsystem through an unsanitized exec call when the undocumented telnetd service is enabled.

The httpd service in Juplink RX4-1500 firmware v1.0.3 through v1.0.5 exposed an unauthenticated setup3.htm endpoint that let a local-network attacker change or access router settings.