CVE-2022-35537: Command Injection
Published Aug 9, 2022
·Updated
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: mac5g and Newname, which leads to command injection in page /wifimesh.shtml.
Affected Software
10 affected components
Wavlink Wn572hp3 Firmware
Wavlink WN572HP3
Wavlink Wn533a8 Firmware
Wavlink WN533A8
Wavlink Wn530h4 Firmware
Wavlink WN530H4
Wavlink Wn535g3 Firmware
Wavlink WN535G3
Wavlink Wn531p3 Firmware
Wavlink WN531P3
Event History
Aug 9, 2022
CVE Published
via MITRE·07:07 PM
Data Sourced
via MITRE·07:07 PM
Description
Frequently Asked Questions
1
What is CVE-2022-35537?
CVE-2022-35537 is a vulnerability in WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 wireless.cgi that allows command injection.
2
What is the severity of CVE-2022-35537?
The severity of CVE-2022-35537 is critical with a CVSS score of 9.8.
3
Which software versions are affected by CVE-2022-35537?
Wavlink Wn572hp3 Firmware, Wavlink Wn533a8 Firmware, Wavlink Wn530h4 Firmware, Wavlink Wn535g3 Firmware, and Wavlink Wn531p3 Firmware are affected by CVE-2022-35537.
4
How does CVE-2022-35537 impact the WAVLINK wireless.cgi page?
CVE-2022-35537 allows command injection in the /wifi_mesh.shtml page of WAVLINK routers.
5
Is there a fix for CVE-2022-35537?
A fix for CVE-2022-35537 is not provided in the information available.