CVE-2022-40623 WAVLINK Quantum D4G (WN531G3) CSRF

High 8.8 Published 13 Sep 2022 Updated 17 Sep 2024

Attackers can exploit missing CSRF tokens to execute remote commands on WAVLINK routers, potentially leading to full device compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2022-40623?

CVE-2022-40623 is a high-severity vulnerability in WAVLINK WN531G3, published on 13 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such as CVE-2022-35518), can lead to remote, unauthenticated command execution.

Weakness: CWE-352

Which versions are affected by CVE-2022-40623?

It affects 1 product.

Products include Wavlink Wn531g3 Firmware.

How do I fix CVE-2022-40623?

No fix has been published for CVE-2022-40623 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-40623 being exploited?

There is no known exploitation of CVE-2022-40623 in the wild and no public exploit code.

Sources

Also known as GHSA-8qfm-5jpx-jp3v.