CVE-2020-12106

9.8 criticalEPSS 1.4%

Critical (9.8) in stengg vpncrypt m10 firmware. EPSS 1.4% chance of exploitation in the next 30 days.

The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows unauthenticated users to send HTTP POST request to several critical Administrative functions such as, changing credentials of the Administrator account or connect the product to a rogue access point.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2020-08-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

stengg:vpncrypt_m10_firmware

References

https://www.stengg.com/cybersecurity
https://www.stengg.com/media/1076253/vpncrypt-m10-cve-advisory-notice.pdf
https://www.stengg.com/cybersecurity
https://www.stengg.com/media/1076253/vpncrypt-m10-cve-advisory-notice.pdf

Check your stack JSON