CVE-2022-35534

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter hiddenSSID32g and SSID2G2, which leads to command injection in page /wifi_multi_ssid.shtml.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2022-08-10

Last modified

2024-08-03

Affected products

• Wn530h4 Firmware (Wavlink)
• Wn531p3 Firmware (Wavlink)
• Wn533a8 Firmware (Wavlink)
• Wn535g3 Firmware (Wavlink)
• Wn572hp3 Firmware (Wavlink)

References

• https://github.com/TyeYeah/othercveinfo/tree/main/wavlink#wavlink-router-ac1200-page-wifi_multi_ssidshtml-command-injec…