CVE-2022-35533: Command Injection
Published Aug 9, 2022
·Updated
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: clilist and clinum, which leads to command injection in page /qos.shtml.
Affected Software
10 affected components
Wavlink Wn572hp3 Firmware
Wavlink WN572HP3
Wavlink Wn533a8 Firmware
Wavlink WN533A8
Wavlink Wn530h4 Firmware
Wavlink WN530H4
Wavlink Wn535g3 Firmware
Wavlink WN535G3
Wavlink Wn531p3 Firmware
Wavlink WN531P3
Event History
Aug 9, 2022
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-35533?
The severity of CVE-2022-35533 is critical with a CVSS score of 9.8.
2
Which software is affected by CVE-2022-35533?
The affected software includes Wavlink Wn572hp3 Firmware, Wavlink Wn533a8 Firmware, Wavlink Wn530h4 Firmware, Wavlink Wn535g3 Firmware, and Wavlink Wn531p3 Firmware.
3
What is the vulnerability in CVE-2022-35533?
The vulnerability in CVE-2022-35533 is command injection in the page /qos.shtml due to no filtering on parameters: cli_list and cli_num.
4
Is Wavlink WN572HP3 vulnerable to CVE-2022-35533?
No, Wavlink WN572HP3 is not vulnerable to CVE-2022-35533.
5
How can I fix CVE-2022-35533?
To fix CVE-2022-35533, it is recommended to apply the latest firmware update provided by Wavlink for the affected devices.