critical9.8

CVE-2022-35518

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /n…

Impact

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /nas_disk.shtml.

Affected products

Vendor	Product	Affected versions
Wavlink	Wn572hp3 Firmware	All versions
Wavlink	Wn533a8 Firmware	All versions
Wavlink	Wn530h4 Firmware	All versions
Wavlink	Wn535g3 Firmware	All versions
Wavlink	Wn531p3 Firmware	All versions

Weakness classification

CWE-77

References

NVD record
CVE.org record
https://github.com/TyeYeah/othercveinfo/blob/main/wavlink/README.md#wavlink-router-ac1200-page-nas_diskshtml-command-injection-in-nascgi
https://github.com/TyeYeah/othercveinfo/blob/main/wavlink/README.md#wavlink-router-ac1200-page-nas_diskshtml-command-injection-in-nascgi