CVE-2022-35521 : WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnable

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilterEnabled and blockSynFloodEnabled, which leads to command injection in page /man_security.shtml.

Published 2022-08-10 20:15:56

Updated 2022-08-15 13:24:02

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-35521

EPSS FAQ

2.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 89 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-35521

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-35521

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2022-35521

Wavlink » Wn530h4 Firmware » Version: N/A
cpe:2.3:o:wavlink:wn530h4_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Wavlink » Wn530h4 » Version: N/A
Wavlink » Wn535g3 Firmware » Version: N/A
cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Wavlink » Wn535g3 » Version: N/A
Wavlink » Wn533a8 Firmware » Version: N/A
cpe:2.3:o:wavlink:wn533a8_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Wavlink » Wn533a8 » Version: N/A
Wavlink » Wn572hp3 Firmware » Version: N/A
cpe:2.3:o:wavlink:wn572hp3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Wavlink » Wn572hp3 » Version: N/A
Wavlink » Wn531p3 Firmware » Version: N/A
cpe:2.3:o:wavlink:wn531p3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Wavlink » Wn531p3 » Version: N/A

Vulnerability Details : CVE-2022-35521

Exploit prediction scoring system (EPSS) score for CVE-2022-35521

CVSS scores for CVE-2022-35521

CWE ids for CVE-2022-35521

References for CVE-2022-35521

Products affected by CVE-2022-35521