Command Injection Vulnerability in WAVLINK Routers
CVE-2024-10428

7.2HIGH

Key Information:

Vendor

Wavlink

Status
Wn530h4
Wn530hg4
Wn572hg3
Vendor
CVE Published:
27 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-10428?

An identified vulnerability in WAVLINK router models WN530H4, WN530HG4, and WN572HG3 pertains to the set_ipv6 function found within the firewall.cgi file. This vulnerability is linked to improper handling of the dhcpGateway parameter, which can lead to command injection vulnerabilities under remote attack vectors. Exploiting this flaw could allow unauthorized users to execute arbitrary commands on the router's operating system, posing significant security threats. The issue remained unaddressed by the vendor despite early notifications, highlighting the urgency for users to take protective measures.

Affected Version(s)

WN530H4 20221028

WN530HG4 20221028

WN572HG3 20221028

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10428 - Proof of Concept

References

https://vuldb.com/?id.281969
vdb-entrytechnical-description
https://vuldb.com/?ctiid.281969
signaturepermissions-required
https://vuldb.com/?submit.427272
third-party-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stellar Lab (VulDB User)
.
CVE-2024-10428 : Command Injection Vulnerability in WAVLINK Routers