PT-2024-16273 · Wavlink · Wavlink Wn530H4+1

Stellar Lab · Published 2024-10-27 · Updated 2024-11-13 · CVE-2024-10428

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WAVLINK WN530H4 versions up to 20221028 WAVLINK WN530HG4 versions up to 20221028 WAVLINK WN572HG3 versions up to 20221028

Description A critical issue affects the set ipv6 function of the firewall.cgi file, where manipulation of the dhcpGateway argument leads to command injection. This issue can be initiated remotely. The vendor was contacted about the disclosure but did not respond.

Recommendations For WAVLINK WN530H4 versions up to 20221028, consider disabling the set ipv6 function in the firewall.cgi file as a temporary workaround until a patch is available. For WAVLINK WN530HG4 versions up to 20221028, consider disabling the set ipv6 function in the firewall.cgi file as a temporary workaround until a patch is available. For WAVLINK WN572HG3 versions up to 20221028, consider disabling the set ipv6 function in the firewall.cgi file as a temporary workaround until a patch is available. Avoid using the dhcpGateway argument in the affected firewall.cgi file until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-10428

Affected Products

Wavlink Wn530H4

Wavlink Wn572Hp3

References · 9

• 🔥 https://vuldb.com/?submit.427272 · Exploit
• 🔥 https://docs.google.com/document/d/11NGSJBOZzbgm_qanDno6SyucWyso7Em6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10428 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10428 · Vendor Advisory
• https://vuldb.com/?ctiid.281969 · Note
• https://t.me/cvedetector/9068 · Telegram Post
• https://vuldb.com/?id.281969 · Note
• https://t.me/cvenotify/99662 · Telegram Post
• https://t.me/latest_high_impact_cve/1397 · Telegram Post