Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware Vulnerability

The Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway is a hardware device that allows users to convert serial connections to Wi-Fi. This vulnerability, discovered in firmware version 3.1.1.0 and hardware version 4.3.2.1, allows attackers to bypass authentication by setting the Administrator password and username as blank values.

Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

To fix this vulnerability, download the patched firmware from Waveshare's website: https://www.waveshare.net/downloads/

Immediate mitigations:

• Restrict network access to your device (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized token creation

• drive.google.com
• otsecverse.github.io