CVE-2022-35522: Command Injection
Published Aug 9, 2022
·Updated
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: pppusername, ppppasswd, rwangateway, rwanmask and rwanip, which leads to command injection in page /wan.shtml.
Affected Software
10 affected components
Wavlink Wn572hp3 Firmware
Wavlink WN572HP3
Wavlink Wn533a8 Firmware
Wavlink WN533A8
Wavlink Wn530h4 Firmware
Wavlink WN530H4
Wavlink Wn535g3 Firmware
Wavlink WN535G3
Wavlink Wn531p3 Firmware
Wavlink WN531P3
Event History
Aug 9, 2022
CVE Published
via MITRE·07:51 PM
Data Sourced
via MITRE·07:51 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2022-35522.
2
What is the severity of CVE-2022-35522?
The severity of CVE-2022-35522 is critical.
3
Which software is affected by CVE-2022-35522?
Wavlink Wn572hp3 Firmware, Wavlink Wn533a8 Firmware, Wavlink Wn530h4 Firmware, Wavlink Wn535g3 Firmware, and Wavlink Wn531p3 Firmware are affected.
4
What is the CWE ID for CVE-2022-35522?
The CWE ID for CVE-2022-35522 is CWE-77.
5
How can I fix the command injection vulnerability in WAVLINK routers?
To fix the command injection vulnerability in WAVLINK routers, apply the latest firmware update provided by the manufacturer.