Command Injection Vulnerability in WAVLINK Routers
CVE-2022-35522
9.8CRITICAL
What is CVE-2022-35522?
A command injection vulnerability exists in the adm.cgi component of WAVLINK routers, including models WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. This flaw arises from the absence of input filtering on critical parameters such as ppp_username, ppp_passwd, rwan_gateway, rwan_mask, and rwan_ip. Attackers can exploit this vulnerability by sending crafted requests to the /wan.shtml page, potentially leading to unauthorized command execution on the affected devices.