Wavlink

Wn535g3 Firmware

23 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2022-35523

Exploit
  • EPSS 5.2%
  • Veröffentlicht 10.08.2022 20:15:55
  • Zuletzt bearbeitet 21.11.2024 07:11:17

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter del_mac and parameter flag, which leads to command injection in page /cli_black_list.shtml.

9.8

CVE-2022-35522

Exploit
  • EPSS 5.2%
  • Veröffentlicht 10.08.2022 20:15:55
  • Zuletzt bearbeitet 21.11.2024 07:11:17

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: ppp_username, ppp_passwd, rwan_gateway, rwan_mask and rwan_ip, which leads to command injection in page /wan.shtml.

9.8

CVE-2022-35520

Exploit
  • EPSS 5.2%
  • Veröffentlicht 10.08.2022 20:15:55
  • Zuletzt bearbeitet 21.11.2024 07:11:17

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn't appear in POST body, but exist in cgi binary. This leads to command injection in page /ledonoff.shtml.

9.8

CVE-2022-35519

Exploit
  • EPSS 5.2%
  • Veröffentlicht 10.08.2022 20:15:54
  • Zuletzt bearbeitet 21.11.2024 07:11:17

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter add_mac, which leads to command injection in page /cli_black_list.shtml.

9.8

CVE-2022-35518

Exploit
  • EPSS 3.48%
  • Veröffentlicht 10.08.2022 20:15:54
  • Zuletzt bearbeitet 20.10.2025 18:15:37

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /nas_disk.shtml.

8.8

CVE-2022-35517

Exploit
  • EPSS 5.07%
  • Veröffentlicht 10.08.2022 20:15:54
  • Zuletzt bearbeitet 21.11.2024 07:11:16

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: web_pskValue, wl_Method, wlan_ssid, EncrypType, rwan_ip, rwan_mask, rwan_gateway, ppp_username, ppp_passwd and ppp_setver, which leads to command injection i...

9.8

CVE-2022-34577

Exploit
  • EPSS 2.17%
  • Veröffentlicht 25.07.2022 22:15:08
  • Zuletzt bearbeitet 21.11.2024 07:09:47

A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.

7.5

CVE-2022-34576

Exploit
  • EPSS 33.42%
  • Veröffentlicht 25.07.2022 22:15:08
  • Zuletzt bearbeitet 21.11.2024 07:09:47

A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.

7.5

CVE-2022-31846

Exploit
  • EPSS 38.2%
  • Veröffentlicht 14.06.2022 14:15:08
  • Zuletzt bearbeitet 21.11.2024 07:05:23

A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.

7.5

CVE-2022-31845

Exploit
  • EPSS 61.68%
  • Veröffentlicht 14.06.2022 14:15:08
  • Zuletzt bearbeitet 21.11.2024 07:05:23

A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.