Vulnerability · Published Jun 23, 2023 · Assigned by VulDB

CVE-2023-3380Wavlink WN579X3 Ping Test adm.cgi injection

Medium 4.7

In plain English

A medium-severity injection in WN579X3 from Wavlink. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)3.9%top 9.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Nuclei

Official description

A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Wavlink	WN579X3	20230615

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.232236 vdb-entry, technical-description
https://vuldb.com/?ctiid.232236 signature, permissions-required
https://github.com/sleepyvv/vul_report/blob/main/WAVLINK/WAVLINK-WN579X3-RCE.md exploit