CVE report
CVE-2020-13117critical
Wavlink Multiple AP - Remote Command Injection
Events 90d
10,657
Distinct IPs
286
Severity
critical
CISA KEV
Not listed
Detection signature
An event counts toward CVE-2020-13117 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /cgi-bin/login.cgi
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 342 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2020-13117
- 216.180.246.12674 eventsUnited States
- 216.180.246.23661 eventsUnited States
- 216.180.246.12460 eventsUnited States
- 216.180.246.14959 eventsUnited States
- 216.180.246.4057 eventsUnited States
- 216.180.246.756 eventsUnited States
- 216.180.246.5456 eventsUnited States
- 216.180.246.22655 eventsUnited States
- 216.180.246.11354 eventsUnited States
- 216.180.246.18153 eventsUnited States
- 216.180.246.20453 eventsUnited States
- 216.180.246.4553 eventsUnited States
- 216.180.246.25053 eventsUnited States
- 216.180.246.1953 eventsUnited States
- 216.180.246.10452 eventsUnited States
- 216.180.246.852 eventsUnited States
- 216.180.246.21552 eventsUnited States
- 216.180.246.1152 eventsUnited States
- 216.180.246.16751 eventsUnited States
- 216.180.246.17351 eventsUnited States
- 216.180.246.15151 eventsUnited States
- 216.180.246.8050 eventsUnited States
- 216.180.246.5250 eventsUnited States
- 216.180.246.15750 eventsUnited States
- 216.180.246.7050 eventsUnited States
- 216.180.246.13650 eventsUnited States
- 216.180.246.6749 eventsUnited States
- 216.180.246.13449 eventsUnited States
- 216.180.246.11649 eventsUnited States
- 216.180.246.15049 eventsUnited States
Top networks the attempts come from
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
Sample request paths observed
- /cgi-bin/login.cgi