CVE-2022-35517

CVE-2022-35517 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3 and WN531P3 due to lack of input filtering in adm.cgi. The vulnerability, described as unfiltered parameters web_pskValue, wl_Method, wlan_ssid, EncrypType, rwan_ip, rwan_mask, rwan_gateway, ppp_username, ppp_passwd, ppp_setver, e...

CVE-2022-35518

The CVE-2022-35518 issue affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 devices where nas.cgi does not filter parameters User1Passwd and User1 in /nas_disk.shtml, enabling command injection. Concrete details in connected sources show the root cause as unfiltered input leading to...

CVE-2022-35519

The CVE-2022-35519 issue affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. Root cause: firewall.cgi does not filter the add_mac parameter, enabling command injection on the /cli_black_list.shtml page. Impact details are stated in the connected Red Hat and CVE records, indicating t...

CVE-2022-35520

CVE-2022-35520 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 where the api.cgi component does not filter the hidden ufconf parameter, which exists in the CGI binary but not in POST data, enabling command injection on the /ledonoff.shtml page. Public references in the connected ...

CVE-2022-35520

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn't appear in POST body, but exist in cgi binary. This leads to command injection in page /ledonoff.shtml...

CVE-2022-35521

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilterEnabled and blockSynFloodEnabled, which leads to command injection in page /mansecurity.shtml...

CVE-2022-35523

CVE-2022-35523 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. The vulnerability is due to no filtering on the del_mac and flag parameters in the firewall.cgi, enabling command injection via the /cli_black_list.shtml page. The root cause is improper input validation in the firew...

CVE-2022-35523

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter delmac and parameter flag, which leads to command injection in page /cliblacklist.shtml...

CVE-2022-35524

The CVE-2022-35524 issue affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 devices. Root cause: adm.cgi lacks filtering on multiple parameters (wlan_signal, web_pskValue, sel_EncrypTyp, sel_Automode, wlan_bssid, wlan_ssid, wlan_channel), enabling command injection on the /wizard_re...

CVE-2022-35524

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: wlansignal, webpskValue, selEncrypTyp, selAutomode, wlanbssid, wlanssid and wlanchannel, which leads to command injection in page /wizardrep.shtml...

CVE-2022-35525

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameter ledswitch, which leads to command injection in page /ledonoff.shtml...

CVE-2022-35525

CVE-2022-35525 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3. adm.cgi has no filtering on the led_switch parameter, enabling command injection via the /ledonoff.shtml page. This is documented in multiple sources (NVD, Red Hat advisory, CVE listing, and CNNVD), indicating a consiste...

CVE-2022-35526

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command injection in page /login.shtml...

CVE-2022-35533

The CVE-2022-35533 issue affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 via the qos.cgi page, where the qos.shtml endpoint lacks filtering on the cli_list and cli_num parameters, enabling command injection. The vulnerability is documented with high severity (CVSS v3.1: 9.8, Netw...

CVE-2022-35533

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: clilist and clinum, which leads to command injection in page /qos.shtml...

CVE-2022-35534

Concrete details found: CVE-2022-35534 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3. The root cause is lack of input filtering in wireless.cgi for parameters hiddenSSID32g and SSID2G2, enabling command injection on the /wifi_multi_ssid.shtml page. Initial and Red Hat entries concu...

CVE-2022-35535

CVE-2022-35535 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3 and WN531P3. The vulnerability stems from lack of filtering on the macAddr parameter in wireless.cgi, enabling command injection on /wifi_mesh.shtml. The coordinated documents corroborate the affected models and the vulnerability ...

CVE-2022-35536

CVE-2022-35536 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. The root cause is lack of input filtering on qos.cgi parameters qos_bandwith and qos_dat, enabling command injection on the /qos.shtml page. NVD lists this as CRITICAL (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, ...

CVE-2022-35536

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qosbandwith and qosdat, which leads to command injection in page /qos.shtml...

CVE-2022-35537

CVE-2022-35537 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3; the wireless.cgi page lacks filtering on mac_5g and Newname parameters, enabling command injection on /wifi_mesh.shtml. Root cause: unsanitized input in wireless.cgi. Impact: high (per CVSS 3.1: Network, Privileges None,...