Remote Command Injection Vulnerability in WAVLINK Devices
CVE-2024-10193

7.2HIGH

Key Information:

Vendor
Wavlink
Status
Wn530h4
Wn530hg4
Wn572hg3
Vendor
CVE Published:
20 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability in WAVLINK routers including models WN530H4, WN530HG4, and WN572HG3 enables attackers to perform command injection via the ping_ddns function located in the internet.cgi file. By manipulating the DDNS argument, an unauthorized attacker can execute arbitrary commands on the affected devices remotely. This exploitation is particularly concerning as it allows potential system compromise without the need for physical access. Acknowledgement of this vulnerability was sought from the vendor prior to public disclosure, but no response was received, amplifying risks for users relying on these affected products.

Affected Version(s)

WN530H4 20221028

WN530HG4 20221028

WN572HG3 20221028

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10193 - Proof of Concept

References

https://vuldb.com/?id.280967
vdb-entrytechnical-description
https://vuldb.com/?ctiid.280967
signaturepermissions-required
https://vuldb.com/?submit.422811
third-party-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stellar Lab (VulDB User)
.