Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war file, with resultant remote code execution. Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26510 Reference (s):
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-033.txt