CVE-2019-7564

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-05-07 · updated 2026-06-17
Weakness: CWE-306

Description

An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type of authentication. By making a POST request to the regx/wireless/wl_security_2G.asp URI, the attacker can change the password of the Wi-FI network.

Affected products

Coship Rt3050 Firmware: 4.0.0.40
Coship Rt3052 Firmware: 4.0.0.48
Coship Rt7620 Firmware: 10.0.0.49
Coship Wm3300 Firmware: 5.0.0.54, 5.0.0.55

References

http://packetstormsecurity.com/files/151595/Coship-Wireless-Router-4.0.0.x-5.0.0.x-Authentication-Bypass.html
http://packetstormsecurity.com/files/151595/Coship-Wireless-Router-4.0.0.x-5.0.0.x-Authentication-Bypass.html

Get alerted when CVE-2019-7564 or the next vulnerability affects your stack