PT-2022-22888 · Wavlink · Wavlink Wn535G3+4

Published 2022-08-09 · Updated 2023-08-08 · CVE-2022-35525

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WAVLINK WN572HP3 WAVLINK WN533A8 WAVLINK WN530H4 WAVLINK WN535G3 WAVLINK WN531P3

Description The issue concerns a lack of filtering on the led switch parameter in the adm.cgi file, which can lead to command injection when accessing the /ledonoff.shtml page.

Recommendations For WAVLINK WN572HP3, consider disabling access to the /ledonoff.shtml page until a fix is available. For WAVLINK WN533A8, restrict the use of the adm.cgi file to prevent command injection. For WAVLINK WN530H4, avoid using the led switch parameter in the adm.cgi file. For WAVLINK WN535G3, limit access to the adm.cgi file to minimize the risk of exploitation. For WAVLINK WN531P3, as a temporary workaround, consider disabling the adm.cgi file until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2022-35525

Affected Products

Wavlink Wn530H4

Wavlink Wn531P3

Wavlink Wn533A8

Wavlink Wn535G3

Wavlink Wn572Hp3

References · 2

• 🔥 https://github.com/TyeYeah/othercveinfo/blob/main/wavlink/README.md#wavlink-router-ac1200-page-ledonoffshtml-command-injection-in-admcgi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35525 · Security Note