Command Injection Vulnerability in WAVLINK Router Models
CVE-2024-10429

7.2HIGH

Key Information:

Vendor

Wavlink

Status
Wn530h4
Wn530hg4
Wn572hg3
Vendor
CVE Published:
27 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-10429?

A critical command injection vulnerability has been identified in WAVLINK networking products, specifically affecting the WN530H4, WN530HG4, and WN572HG3 models, prior to a specific firmware release. The issue resides in the handling of input parameters within the 'set_ipv6' function of the 'internet.cgi' file. Attackers can exploit this weakness by manipulating parameters such as IPv6OpMode, IPv6IPAddr, IPv6WANIPAddr, and IPv6GWAddr. This allows remote unauthorized users to execute arbitrary commands on the affected devices. The vulnerability poses a significant risk as it can be exploited without local access, emphasizing the urgent need for users to review their device configurations and apply necessary security patches.

Affected Version(s)

WN530H4 20221028

WN530HG4 20221028

WN572HG3 20221028

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10429 - Proof of Concept

References

https://vuldb.com/?id.281970
vdb-entrytechnical-description
https://vuldb.com/?ctiid.281970
signaturepermissions-required
https://vuldb.com/?submit.427274
third-party-advisory

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stellar Lab (VulDB User)
.
CVE-2024-10429 : Command Injection Vulnerability in WAVLINK Router Models