CVE-2020-12266

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed externally without any authentication. All the pages follow the naming convention live_(string).shtml. Among the information disclosed is: interface status logs, IP address of the device, MAC address of the device, model and current firmware version, location, all running processes, all interfaces and their statuses, all current DHCP leases and the associated hostnames, all other wireless networks in range of the router, memory statistics, and components of the configuration of the device such as enabled features. Affected devices: Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000

• CWE-306

• https://github.com/Roni-Carta/nyraNot Applicable, Third Party Advisory
• https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-12266Third Party Advisory
• https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-12266-affected_devicesThird Party Advisory
• https://github.com/sudo-jtcsec/NyraBroken Link
• https://www.wavlink.comVendor Advisory
• https://github.com/Roni-Carta/nyraNot Applicable, Third Party Advisory
• https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-12266Third Party Advisory
• https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-12266-affected_devicesThird Party Advisory
• https://github.com/sudo-jtcsec/NyraBroken Link
• https://www.wavlink.comVendor Advisory

Published

Apr 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12258rConfig 3.9.4 is vulnerable to session fixation because sess…9.1
• CVE-2020-12259rConfig 3.9.4 is vulnerable to reflected XSS. The configDevi…5.4
• CVE-2020-1226A remote code execution vulnerability exists in Microsoft Ex…8.8
• CVE-2020-12261Open-AudIT 3.3.0 allows an XSS attack after login.5.4
• CVE-2020-12262Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TI…5.4
• CVE-2020-12265The decompress package before 4.2.1 for Node.js is vulnerabl…9.8
• CVE-2020-12267setMarkdown in Qt before 5.14.2 has a use-after-free related…9.8
• CVE-2020-12268jbig2_image_compose in jbig2_image.c in Artifex jbig2dec bef…9.8
• CVE-2020-1227<p>A cross-site-scripting (XSS) vulnerability exists when Mi…5.4
• CVE-2020-12270React Native Bluetooth Scan in Bluezone 1.0.0 uses six-chara…6.5
• CVE-2020-12271A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, an…9.8
• CVE-2020-12272OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject…5.3