CVE-2024-10428: WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set_ipv6 command injection
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function setipv6 of the file firewall.cgi. The manipulation of the argument dhcpGateway leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10428?
CVE-2024-10428 has been rated as critical.
What systems are affected by CVE-2024-10428?
CVE-2024-10428 affects WAVLINK WN530H4, WN530HG4, and WN572HG3 firmware versions up to 20221028.
What type of vulnerability is CVE-2024-10428?
CVE-2024-10428 is a command injection vulnerability caused by improper input handling in the function set_ipv6 of the file firewall.cgi.
How can I mitigate CVE-2024-10428?
To mitigate CVE-2024-10428, update your device firmware to the latest version that addresses this vulnerability.
How does the command injection in CVE-2024-10428 occur?
Command injection in CVE-2024-10428 occurs through manipulation of the argument dhcpGateway.