Lucene search
HistoryAug 10, 2022 - 8:15 p.m.
CVE-2022-35520
wavlink wn572hp3
wn533a8
wn530h4
wn535g3
wn531p3
api.cgi
command injection
ledonoff.shtml
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.021
Percentile
89.3%
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn’t appear in POST body, but exist in cgi binary. This leads to command injection in page /ledonoff.shtml.
Affected configurations
Node
wavlinkwn572hp3_firmwareMatch-
wavlinkwn572hp3Match-
Node
wavlinkwn533a8_firmwareMatch-
wavlinkwn533a8Match-
Node
wavlinkwn530h4_firmwareMatch-
wavlinkwn530h4Match-
Node
wavlinkwn535g3_firmwareMatch-
wavlinkwn535g3Match-
Node
wavlinkwn531p3_firmwareMatch-
wavlinkwn531p3Match-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| wavlink | wn572hp3_firmware | - | cpe:2.3:o:wavlink:wn572hp3_firmware:-:*:*:*:*:*:*:* |
| wavlink | wn572hp3 | - | cpe:2.3:h:wavlink:wn572hp3:-:*:*:*:*:*:*:* |
| wavlink | wn533a8_firmware | - | cpe:2.3:o:wavlink:wn533a8_firmware:-:*:*:*:*:*:*:* |
| wavlink | wn533a8 | - | cpe:2.3:h:wavlink:wn533a8:-:*:*:*:*:*:*:* |
| wavlink | wn530h4_firmware | - | cpe:2.3:o:wavlink:wn530h4_firmware:-:*:*:*:*:*:*:* |
| wavlink | wn530h4 | - | cpe:2.3:h:wavlink:wn530h4:-:*:*:*:*:*:*:* |
| wavlink | wn535g3_firmware | - | cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:* |
| wavlink | wn535g3 | - | cpe:2.3:h:wavlink:wn535g3:-:*:*:*:*:*:*:* |
| wavlink | wn531p3_firmware | - | cpe:2.3:o:wavlink:wn531p3_firmware:-:*:*:*:*:*:*:* |
| wavlink | wn531p3 | - | cpe:2.3:h:wavlink:wn531p3:-:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2022-35520
2022-08-09 19:53:56
cve
cve
CVE-2022-35520
2022-08-10 20:15:55
prion
prion
Command injection
2022-08-10 20:15:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.021
Percentile
89.3%
Related for NVD:CVE-2022-35520