Arbitrary File Upload and OS Command Execution in Wavlink Wireless Devices
CVE-2023-32621

7.2HIGH

Key Information:

Vendor: Wavlink Technology Ltd.
Status: Wl-wn531ax2
Vendor: CVE Published:; 30 June 2023

🔔 Create Wavlink Technology Ltd. Vulnerability Alert

What is CVE-2023-32621?

The WL-WN531AX2 firmware, specifically versions prior to 2023526, contains a vulnerability that allows an attacker with administrative privileges to upload arbitrary files. This weakness can lead to the execution of operating system commands with root privileges, potentially compromising the integrity and security of the device. Users are advised to update their firmware immediately to mitigate this risk.

Affected Version(s)

WL-WN531AX2 firmware versions prior to 2023526

References

https://www.wavlink.com/en_us/firmware/details/932108ffc5...

https://jvn.jp/en/jp/JVN78634340/

CVSS V3.1

Score:

7.2

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 30, 2023
Vulnerability Reserved
May 11, 2023

CVE-2023-32621 Data

JSON