CVE-2025-43988

Published: Aug 13, 2025Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials.

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (4)

https://drive.proton.me/urls/9EB08033PW#2b7dTc2x705W

Source: cve@mitre.org

https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43988.txt

Source: cve@mitre.org

https://github.com/actuator/cve/tree/main/Kuwfi

Source: cve@mitre.org

https://kuwfi.com/products/nsa-sa-25gbps-kuwfi-6000mah-wifi-router-5g-dual-band-128users-portable-5g-wifi-router-with-sim-card-slot

Source: cve@mitre.org

Timeline

No history available yet.