CVE-2020-12124
published 2020-10-02CVE-2020-12124: A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute…
PriorityP190critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
75.22%
99.5th percentile
A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wavlink | wn530h4_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Wavlink WN530H4 live_api.cgi ip Parameter Command Injection Attempt (CVE-2020-12124)"; flow:established,to_server; http.request_line; content:"GET /cgi-bin/live_api.cgi?"; startswith; fast_pattern; content:"ip="; distance:0; pcre:"/^.{0,10}(?:\x60|\x24\x28|\x3b|%60|%3[bB]|%24%28)/R"; reference:cve,2020-12124; reference:url,github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12124.yaml; classtype:attempted-admin; sid:2056379; rev:1; metadata:affected_product Wavlink, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_10_01, cve CVE_2020_12124, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_10_01, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)- →Exploit requests are unauthenticated HTTP GET requests to /cgi-bin/live_api.cgi with the `ip` parameter containing shell injection metacharacters (backtick, $(), semicolon, or their URL-encoded equivalents %60, %3b, %24%28). ↗
- →Exploit responses also contain the string 'WiFiBand' in the body alongside command output, which can be used as a secondary confirmation of the vulnerable endpoint being hit. ↗
- →Use Shodan or FOFA to identify exposed WAVLINK devices as potential targets: Shodan query `http.html:"wavlink"`, FOFA query `body="wavlink"`. ↗
- →The vulnerability is exploitable only over plaintext HTTP (not TLS); perimeter and internal network monitoring should focus on unencrypted traffic to this endpoint. ↗
- ·The Nuclei template uses randomized path and id parameters (`rand_base(3)` and `rand_int(1,10)`) alongside the injected `ip` parameter; detection rules matching only on a static URL pattern may miss exploit attempts that vary these values. ↗
- ·The ET Snort rule (sid:2056379) anchors on the request line starting with `GET /cgi-bin/live_api.cgi?` and then checks the `ip=` parameter within the first 10 characters for injection chars; POST-based or path-varied requests would evade this rule. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qjcv-q7cx-q8cc: A remote command-line injection vulnerability in the /cgi-bin/live_api
ghsa_unreviewed·2022-05-24
CVE-2020-12124 [CRITICAL] GHSA-qjcv-q7cx-q8cc: A remote command-line injection vulnerability in the /cgi-bin/live_api
A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.
VulnCheck
wavlink wn530h4_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2020·CVSS 9.8
CVE-2020-12124 [CRITICAL] wavlink wn530h4_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
wavlink wn530h4_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.
Affected: wavlink wn530h4_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-30&host_type=src&vulnerability=cve-2020-12124; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-01&host_type=src&vulnerability=c
Suricata
ET WEB_SPECIFIC_APPS Wavlink WN530H4 live_api.cgi ip Parameter Command Injection Attempt (CVE-2020-12124)
suricata·2024-10-01·CVSS 9.8
CVE-2020-12124 [CRITICAL] ET WEB_SPECIFIC_APPS Wavlink WN530H4 live_api.cgi ip Parameter Command Injection Attempt (CVE-2020-12124)
ET WEB_SPECIFIC_APPS Wavlink WN530H4 live_api.cgi ip Parameter Command Injection Attempt (CVE-2020-12124)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Wavlink WN530H4 live_api.cgi ip Parameter Command Injection Attempt (CVE-2020-12124)"; flow:established,to_server; http.request_line; content:"GET /cgi-bin/live_api.cgi?"; startswith; fast_pattern; content:"ip="; distance:0; pcre:"/^.{0,10}(?:\x60|\x24\x28|\x3b|%60|%3[bB]|%24%28)/R"; reference:cve,2020-12124; reference:url,github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-12124.yaml; classtype:attempted-admin; sid:2056379; rev:1; metadata:affected_product Wavlink, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_10_01, cve CVE_2020_12124, deployment Perimeter, depl
Nuclei
WAVLINK WN530H4 live_api.cgi - Command Injection
nuclei·CVSS 9.8
CVE-2020-12124 [CRITICAL] WAVLINK WN530H4 live_api.cgi - Command Injection
WAVLINK WN530H4 live_api.cgi - Command Injection
A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.
Template:
id: CVE-2020-12124
info:
name: WAVLINK WN530H4 live_api.cgi - Command Injection
author: DhiyaneshDK
severity: critical
description: |
A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.
impact: |
Unauthenticated attackers can execute arbitrary Linux commands as root on the WAVLINK WN530H4 device, potentially leading to complete system compromise, data theft, or
2020-10-02
Published
Exploited in the wild