CVE-2021-28936

HighCVSS 7.5

Published: 29/03/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.03%

79th percentile - higher than 79% of all known CVEs

Summary

The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) web management allows changing the administrator password via a crafted HTTP GET request without prior authentication, only requiring knowledge of the default username (admin).

Risk Assessment

An attacker can gain full control over the device by changing the admin password without authorization, leading to network security compromise.

Recommendation

Immediately update the device firmware to the latest version or replace it with a model that has proper security fixes. If no update is available, consider decommissioning the device.

Other vulnerabilities in Acexy Wireless-N WiFi Repeater

CVE-2021-28937High
The /password.html page of the Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) web management interface exposes the administrator password in plaintext. The page can be intercepted over HTTP.

Original NVD description (English source)

The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web management administrator password can be changed by sending a specially crafted HTTP GET request. The administrator username has to be known (default:admin) whereas no previous authentication is required.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS