PT-2022-22223 · Wavlink · Wavlink Wl-Wn575A3

Published 2022-07-07 · Updated 2023-08-01 · CVE-2022-34592

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN575A3 version RPT75A3.V4300.201217

Description A command injection issue was discovered, allowing attackers to execute arbitrary commands via a crafted POST request to the obtw function. This enables attackers to send malicious requests and potentially gain unauthorized access to the system.

Recommendations For version RPT75A3.V4300.201217, as a temporary workaround, consider restricting access to the obtw function until a patch is available. Additionally, avoid using the vulnerable function to process untrusted input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-34592

Affected Products

Wavlink Wl-Wn575A3

References · 7

• 🔥❌ https://github.com/winmt/CVE/blob/main/WAVLINK%20WL-WN575A3/README.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-34592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34592 · Security Note
• ❌ https://github.com/winmt/my-vuls/tree/main/WAVLINK%20WL-WN575A3 · Note, Deleted
• https://t.me/cvenotify/32750 · Telegram Post
• https://t.me/cvenotify/33154 · Telegram Post
• https://t.me/cibsecurity/45775 · Telegram Post