CVE-2022-35519

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter add_mac, which leads to command injection in page /cli_black_list.shtml.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2022-08-10

Last modified

2024-08-03

Affected products

• Wn530h4 Firmware (Wavlink)
• Wn531p3 Firmware (Wavlink)
• Wn533a8 Firmware (Wavlink)
• Wn535g3 Firmware (Wavlink)
• Wn572hp3 Firmware (Wavlink)

References

• https://github.com/TyeYeah/othercveinfo/blob/main/wavlink/README.md#command-injection-occurs-when-deleting-blacklist-in…