PT-2022-22884 · Wavlink · Wavlink Wn535G3+4

Published 2022-08-09 · Updated 2023-08-08 · CVE-2022-35521

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAVLINK WN572HP3 WAVLINK WN533A8 WAVLINK WN530H4 WAVLINK WN535G3 WAVLINK WN531P3

Description The issue is related to the firewall.cgi having no filtering on parameters: remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilterEnabled, and blockSynFloodEnabled. This lack of filtering leads to command injection in the page /man security.shtml.

Recommendations For WAVLINK WN572HP3, consider disabling the firewall.cgi until a patch is available. For WAVLINK WN533A8, restrict access to the /man security.shtml page to minimize the risk of exploitation. For WAVLINK WN530H4, avoid using the parameters remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilterEnabled, and blockSynFloodEnabled in the firewall.cgi until the issue is resolved. For WAVLINK WN535G3, restrict access to the firewall.cgi to minimize the risk of exploitation. For WAVLINK WN531P3, consider disabling the firewall.cgi until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2022-35521

Affected Products

Wavlink Wn530H4

Wavlink Wn531P3

Wavlink Wn533A8

Wavlink Wn535G3

Wavlink Wn572Hp3

References · 4

• 🔥 https://github.com/TyeYeah/othercveinfo/blob/main/wavlink/README.md#wavlink-router-ac1200-page-man_securityshtml-command-injection-in-firewallcgi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35521 · Security Note
• https://t.me/cibsecurity/47906 · Telegram Post
• https://t.me/cvenotify/34670 · Telegram Post