PT-2023-24503 · Wavlink · Wavlink Wn579X3

Wwesleywww · Publicado 2023-06-23 · Atualizado 2024-05-17 · CVE-2023-3380

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wavlink WN579X3 versions up to 20230615

Description A critical issue has been discovered, affecting an unknown function of the /cgi-bin/adm.cgi file in the Ping Test component. The manipulation of the pingIp argument leads to injection. This issue can be exploited remotely.

Recommendations For Wavlink WN579X3 versions up to 20230615, consider restricting access to the /cgi-bin/adm.cgi file until a fix is available. As a temporary workaround, avoid using the pingIp argument in the affected Ping Test component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2023-3380

Produtos afetados

Wavlink Wn579X3

Referências · 5

• 🔥 https://github.com/sleepyvv/vul_report/blob/main/WAVLINK/WAVLINK-WN579X3-RCE.md · Exploit
• https://vuldb.com/?id.232236 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3380 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-3380 · Aviso do Fabricante
• https://vuldb.com/?ctiid.232236 · Nota