PT-2024-16106 · Wavlink · Wavlink Wn530H4+1

Stellar Lab

·

Published

2024-10-12

·

Updated

2024-10-23

·

CVE-2024-10193

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 versions up to 20221028 WAVLINK WN530HG4 versions up to 20221028 WAVLINK WN572HG3 versions up to 20221028
Description A critical issue affects the function ping ddns of the file internet.cgi. The manipulation of the argument DDNS leads to command injection. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Recommendations For WAVLINK WN530H4 versions up to 20221028, consider disabling the ping ddns function until a patch is available. For WAVLINK WN530HG4 versions up to 20221028, restrict access to the internet.cgi file to minimize the risk of exploitation. For WAVLINK WN572HG3 versions up to 20221028, avoid using the DDNS argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-05204
CVE-2024-10193

Affected Products

Wavlink Wn530H4
Wavlink Wn572Hp3