PT-2023-24503 · Wavlink · Wavlink Wn579X3

Wwesleywww · Published 2023-06-23 · Updated 2024-05-17 · CVE-2023-3380

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wavlink WN579X3 versions up to 20230615

Description A critical issue has been discovered, affecting an unknown function of the /cgi-bin/adm.cgi file in the Ping Test component. The manipulation of the pingIp argument leads to injection. This issue can be exploited remotely.

Recommendations For Wavlink WN579X3 versions up to 20230615, consider restricting access to the /cgi-bin/adm.cgi file until a fix is available. As a temporary workaround, avoid using the pingIp argument in the affected Ping Test component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-3380

Affected Products

Wavlink Wn579X3

References · 5

• 🔥 https://github.com/sleepyvv/vul_report/blob/main/WAVLINK/WAVLINK-WN579X3-RCE.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-3380 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3380 · Vendor Advisory
• https://vuldb.com/?id.232236 · Note
• https://vuldb.com/?ctiid.232236 · Note