Cross-Site Scripting Vulnerability Found in WAVLINK WN535 G3 Product
CVE-2022-30489

6.1MEDIUM

Key Information:

Vendor

Wavlink

Status
Wn535g3 Firmware
Vendor
CVE Published:
13 May 2022

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 16%

What is CVE-2022-30489?

The WAVLINK WN535 G3 router has been identified with a cross-site scripting (XSS) vulnerability. This issue arises from improper handling of the hostname parameter in the /cgi-bin/login.cgi endpoint, potentially allowing attackers to execute arbitrary JavaScript code in the context of the user's browser. Exploiting this vulnerability could lead to unauthorized actions being performed by unsuspecting users, thereby compromising the security and privacy of sensitive information.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

XSS-CVE-2022-30489
Created by badboycxcc

References

https://github.com/badboycxcc/XSS
x_refsource_MISC

EPSS Score

16% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.