CVE-2022-35517 Command injection in n/a
Attackers can execute arbitrary commands on WAVLINK routers via unfiltered parameters in the admin interface, requiring immediate attention from network administrators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-35517?
CVE-2022-35517 is a high-severity command injection vulnerability in n/a, published on 9 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: web_pskValue, wl_Method, wlan_ssid, EncrypType, rwan_ip, rwan_mask, rwan_gateway, ppp_username, ppp_passwd and ppp_setver, which leads to command injection in page /wizard_router_mesh.shtml.
Which versions are affected by CVE-2022-35517?
It affects 5 products.
Products include Wavlink Wn530h4 Firmware, Wavlink Wn531p3 Firmware, Wavlink Wn533a8 Firmware, Wavlink Wn535g3 Firmware, Wavlink Wn572hp3 Firmware.
How do I fix CVE-2022-35517?
No fix has been published for CVE-2022-35517 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-35517 being exploited?
There is no known exploitation of CVE-2022-35517 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mrfv-4v7g-63c2.