Vulnerability · Published Jul 20, 2022 · Assigned by VulDB

CVE-2022-2488WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection

High 8.0

In plain English

A high-severity OS command injection in WN535K2 from WAVLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 33.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)33.4%top 1.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
WAVLINK	WN535K2	n/a
WAVLINK	WN535K3	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md x_refsource_MISC
https://vuldb.com/?id.204539 x_refsource_MISC
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1999