Unrated

Askey AP5100W Configuration Backup Exposure

IdentifiersCVE-2020-25545CWE-200

CVE-2020-25545 affects the Askey AP5100W Wi-Fi mesh node, tested on firmware Dual_SIG_1.01.071. The device web interface exposes functionality to generate and download a configuration backup. According to the provided content, an authenticated attacker can invoke status.cgi with parameters such as service=cfgbackup and act=nvset to create a backup, then retrieve the archive from /configs/config.tar. The downloaded configuration archive contains sensitive information including the web interface administrator password, Wi-Fi password, and other configuration data. The content further states that if a configuration backup already exists, the archive may be retrievable without authentication, regardless of current login state.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation exposes sensitive configuration data stored on the device, including administrator credentials for the web interface and Wi-Fi credentials. This can enable unauthorized administrative access to the AP5100W, compromise of the local wireless network, and facilitate chaining with other vulnerabilities on the device, including authenticated attack paths that require valid admin credentials. In practice, the issue provides attackers with credential disclosure and broader compromise of device management and network access.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the AP5100W management interface to trusted administrative hosts only, disable or tightly control remote/local web administration exposure where possible, remove any existing configuration backup files from the device if feasible, and immediately change exposed administrator and Wi-Fi credentials. Because default credentials were noted in the provided content, ensure defaults are replaced with strong unique passwords. Network segmentation to prevent untrusted or guest users from reaching the management interface will reduce exploitability.

Remediation

Patch, then assume compromise.

The provided content does not include a vendor-issued fix or patch guidance. Remediation would require applying an updated firmware version from Askey or the service provider that restricts access to configuration backup generation and download, enforces proper authorization checks on backup files, and prevents unauthenticated retrieval of previously generated archives. If no fixed firmware is available, the information is currently not available from the provided content.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

starlabs sgNews

May 22, 2020

(CVE-2020-15357) Askey AP5100W Authenticated Command Injection in web Interface | STAR Labs

A vulnerability in the Askey AP5100W referenced as part of a chained exploit to obtain the admin login password for the web interface, but not described in detail in this content.

starlabs sgNews

May 22, 2020

(CVE-2020-25545) Askey AP5100W Information Leak through Insecure backups | STAR Labs

An information disclosure vulnerability in the Askey AP5100W web interface that allows retrieval of a configuration backup containing sensitive credentials, including admin and Wi-Fi passwords; in some cases the backup can be obtained without authentication.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity