Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify the network configu...
Vendor
a-link vulnerabilities
2 published CVES affecting a-link, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest a-link CVEs
Newest publication first
-
MediumCVSS 6.8 EPSS 1.5%
-
HighCVSS 10.0 EPSS 3.6%
The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin account, which makes it easier for remote attackers to obtain access.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.