CVE-2025-43988

high

Description

KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials.

References

https://kuwfi.com/products/nsa-sa-25gbps-kuwfi-6000mah-wifi-router-5g-dual-band-128users-portable-5g-wifi-router-with-sim-card-slot

https://github.com/actuator/cve/tree/main/Kuwfi

https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43988.txt

https://drive.proton.me/urls/9EB08033PW#2b7dTc2x705W

Details

Source: Mitre, NVD

Published: 2025-08-13

Updated: 2025-08-14

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N