CVE-2022-35525: Command Injection
Published Aug 9, 2022
·Updated
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameter ledswitch, which leads to command injection in page /ledonoff.shtml.
Affected Software
10 affected components
Wavlink Wn572hp3 Firmware
Wavlink WN572HP3
Wavlink Wn533a8 Firmware
Wavlink WN533A8
Wavlink Wn530h4 Firmware
Wavlink WN530H4
Wavlink Wn535g3 Firmware
Wavlink WN535G3
Wavlink Wn531p3 Firmware
Wavlink WN531P3
Event History
Aug 9, 2022
CVE Published
via MITRE·07:47 PM
Data Sourced
via MITRE·07:47 PM
Description
Frequently Asked Questions
1
What is CVE-2022-35525?
CVE-2022-35525 is a vulnerability in WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 routers that allows command injection in page /ledonoff.shtml.
2
How severe is CVE-2022-35525?
CVE-2022-35525 has a severity rating of 9.8 (critical).
3
Which software versions are affected by CVE-2022-35525?
Wavlink Wn572hp3 Firmware, Wavlink Wn533a8 Firmware, Wavlink Wn530h4 Firmware, Wavlink Wn535g3 Firmware, and Wavlink Wn531p3 Firmware are affected by CVE-2022-35525.
4
What is the CWE ID for CVE-2022-35525?
The CWE ID for CVE-2022-35525 is 77.
5
How can I fix CVE-2022-35525?
There is currently no known fix for CVE-2022-35525. It is recommended to update the firmware of affected WAVLINK routers when a security patch becomes available.