CVE-2022-35536

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qos_bandwith and qos_dat, which leads to command injection in page /qos.shtml.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:wavlink:wn572hp3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn572hp3:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:wavlink:wn533a8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn533a8:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:wavlink:wn530h4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn530h4:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn535g3:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:wavlink:wn531p3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn531p3:-:*:*:*:*:*:*:*

History

08 Aug 2023, 14:21

Type Values Removed Values Added
CWE CWE-77 NVD-CWE-Other

15 Aug 2022, 12:38

Type Values Removed Values Added
CPE cpe:2.3:o:wavlink:wn530h4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn530h4:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn535g3:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn533a8:-:*:*:*:*:*:*:*
cpe:2.3:o:wavlink:wn572hp3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn572hp3:-:*:*:*:*:*:*:*
cpe:2.3:o:wavlink:wn535g3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:wavlink:wn531p3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wn531p3:-:*:*:*:*:*:*:*
cpe:2.3:o:wavlink:wn533a8_firmware:-:*:*:*:*:*:*:*
First Time Wavlink wn572hp3 Firmware
Wavlink
Wavlink wn533a8
Wavlink wn572hp3
Wavlink wn530h4
Wavlink wn531p3
Wavlink wn533a8 Firmware
Wavlink wn531p3 Firmware
Wavlink wn535g3 Firmware
Wavlink wn535g3
Wavlink wn530h4 Firmware
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8
CWE CWE-77
References (MISC) https://github.com/TyeYeah/othercveinfo/tree/main/wavlink#wavlink-router-ac1200-page-qosshtml-command-injection-in-qoscgi - (MISC) https://github.com/TyeYeah/othercveinfo/tree/main/wavlink#wavlink-router-ac1200-page-qosshtml-command-injection-in-qoscgi - Exploit, Third Party Advisory

10 Aug 2022, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-08-10 20:15

Updated : 2023-12-10 14:35


NVD link : CVE-2022-35536

Mitre link : CVE-2022-35536

CVE.ORG link : CVE-2022-35536


JSON object : View

Products Affected

wavlink

  • wn535g3_firmware
  • wn533a8_firmware
  • wn535g3
  • wn531p3_firmware
  • wn533a8
  • wn530h4
  • wn572hp3
  • wn572hp3_firmware
  • wn530h4_firmware
  • wn531p3