CVE-2022-35536

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qos_bandwith and qos_dat, which leads to command injection in page /qos.shtml.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2022-08-10

Last modified

2024-08-03

Affected products

• Wn530h4 Firmware (Wavlink)
• Wn531p3 Firmware (Wavlink)
• Wn533a8 Firmware (Wavlink)
• Wn535g3 Firmware (Wavlink)
• Wn572hp3 Firmware (Wavlink)

References

• https://github.com/TyeYeah/othercveinfo/tree/main/wavlink#wavlink-router-ac1200-page-qosshtml-command-injection-in-qosc…