CVE-2022-35520: Command Injection
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn't appear in POST body, but exist in cgi binary. This leads to command injection in page /ledonoff.shtml.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-35520?
CVE-2022-35520 is a vulnerability found in WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 routers, where the api.cgi script does not filter the ufconf parameter, allowing for command injection in the /ledonoff.shtml page.
How severe is CVE-2022-35520?
CVE-2022-35520 has a severity value of 9.8, which is considered critical.
What software is affected by CVE-2022-35520?
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 routers are affected by CVE-2022-35520.
How can I fix CVE-2022-35520?
There is currently no official fix or patch available for CVE-2022-35520. It is recommended to update to the latest firmware version provided by the vendor if one becomes available in the future.
Where can I find more information about CVE-2022-35520?
You can find more information about CVE-2022-35520 at the following link: [GitHub - Wavlink Router AC1200 - Page /ledonoff.shtml Hidden Parameter 'ufconf' Command Injection in api.cgi](https://github.com/TyeYeah/othercveinfo/blob/main/wavlink/README.md#wavlink-router-ac1200-page-ledonoffshtml-hidden-parameter-ufconf-command-injection-in-apicgi)