cbcvebase.
CVE-2022-31845
published 2022-06-14

CVE-2022-31845: A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec…

PriorityP354high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
8.17%
94.2th percentile
A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.

Affected

1 ranges
VendorProductVersion rangeFixed in
wavlinkwn535g3_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/live_check.shtml↗
otherModel=↗
otherFW_Version=↗
otherLanIP=↗
  • →Send an unauthenticated HTTP GET request to /live_check.shtml; a vulnerable device will respond HTTP 200 with body containing 'Model=', 'FW_Version=', and 'LanIP=' strings, indicating sensitive router information disclosure. ↗
  • →Shodan queries 'http.html:"Wavlink"', 'http.html:"wavlink"', and 'http.title:"wi-fi app login"' can be used to identify exposed WAVLINK devices on the internet. ↗
  • →FOFA queries 'title="wi-fi app login"' and 'body="wavlink"' can identify potentially vulnerable WAVLINK devices. ↗
  • →Google dork 'intitle:"wi-fi app login"' can surface publicly exposed WAVLINK router login pages. ↗
  • ·Vulnerability is specific to firmware version M35G3R.V5030.180927 on the WAVLINK WN535 G3 device; other firmware versions may not be affected. ↗
  • ·The vulnerability requires no authentication (PR:N, UI:N) and is remotely exploitable over the network (AV:N), meaning any unauthenticated attacker with network access can trigger it. ↗

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.