CVE-2022-35524

The CVE-2022-35524 issue affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 devices. Root cause: adm.cgi lacks filtering on multiple parameters (wlan_signal, web_pskValue, sel_EncrypTyp, sel_Automode, wlan_bssid, wlan_ssid, wlan_channel), enabling command injection on the /wizard_re...

CVE-2022-35524

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: wlansignal, webpskValue, selEncrypTyp, selAutomode, wlanbssid, wlanssid and wlanchannel, which leads to command injection in page /wizardrep.shtml...

CVE-2022-35525

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameter ledswitch, which leads to command injection in page /ledonoff.shtml...

CVE-2022-35525

CVE-2022-35525 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3. adm.cgi has no filtering on the led_switch parameter, enabling command injection via the /ledonoff.shtml page. This is documented in multiple sources (NVD, Red Hat advisory, CVE listing, and CNNVD), indicating a consiste...

CVE-2022-35526

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command injection in page /login.shtml...

CVE-2022-35533

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: clilist and clinum, which leads to command injection in page /qos.shtml...

CVE-2022-35533

The CVE-2022-35533 issue affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 via the qos.cgi page, where the qos.shtml endpoint lacks filtering on the cli_list and cli_num parameters, enabling command injection. The vulnerability is documented with high severity (CVSS v3.1: 9.8, Netw...

CVE-2022-35534

Concrete details found: CVE-2022-35534 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3. The root cause is lack of input filtering in wireless.cgi for parameters hiddenSSID32g and SSID2G2, enabling command injection on the /wifi_multi_ssid.shtml page. Initial and Red Hat entries concu...

CVE-2022-35535

CVE-2022-35535 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3 and WN531P3. The vulnerability stems from lack of filtering on the macAddr parameter in wireless.cgi, enabling command injection on /wifi_mesh.shtml. The coordinated documents corroborate the affected models and the vulnerability ...

CVE-2022-35536

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qosbandwith and qosdat, which leads to command injection in page /qos.shtml...

CVE-2022-35536

CVE-2022-35536 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. The root cause is lack of input filtering on qos.cgi parameters qos_bandwith and qos_dat, enabling command injection on the /qos.shtml page. NVD lists this as CRITICAL (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, ...

CVE-2022-35537

CVE-2022-35537 affects WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3; the wireless.cgi page lacks filtering on mac_5g and Newname parameters, enabling command injection on /wifi_mesh.shtml. Root cause: unsanitized input in wireless.cgi. Impact: high (per CVSS 3.1: Network, Privileges None,...

CVE-2022-35538

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: deletelist, deletealmac, bdeletelist and bdeletealmac, which leads to command injection in page /wifimesh.shtml...

PT-2022-22891 · Wavlink · Wavlink Wn530H4 +4

Name of the Vulnerable Software and Affected Versions: WAVLINK WN572HP3 WAVLINK WN533A8 WAVLINK WN530H4 WAVLINK WN535G3 WAVLINK WN531P3 Description: The issue affects the qos.cgi page, specifically the /qos.shtml endpoint, where the cli list and cli num parameters have no filtering, leading to...

PT-2022-22879 · Wavlink · Wavlink Wn530H4 +4

Name of the Vulnerable Software and Affected Versions: WAVLINK WN572HP3 WAVLINK WN533A8 WAVLINK WN530H4 WAVLINK WN535G3 WAVLINK WN531P3 Description: The issue concerns the lack of filtering on certain parameters in the adm.cgi file, specifically: web pskValue, wl Method, wlan ssid, EncrypType, rw...

CVE-2022-35537: Undefined Security Weakness

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: mac5g and Newname, which leads to command injection in page /wifimesh.shtml...

CVE-2022-35517: Undefined Security Weakness

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: webpskValue, wlMethod, wlanssid, EncrypType, rwanip, rwanmask, rwangateway, pppusername, ppppasswd and pppsetver, which leads to command injection in page /wizardroutermesh.shtml...

CVE-2022-35523: Undefined Security Weakness

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter delmac and parameter flag, which leads to command injection in page /cliblacklist.shtml...

CVE-2022-35524: Undefined Security Weakness

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: wlansignal, webpskValue, selEncrypTyp, selAutomode, wlanbssid, wlanssid and wlanchannel, which leads to command injection in page /wizardrep.shtml...

CVE-2022-35521: Undefined Security Weakness

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilterEnabled and blockSynFloodEnabled, which leads to command injection in page /mansecurity.shtml...