CVE-2022-40621: Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing…

PriorityP347high7.5CVSS 3.1

AVNACHPRLUINSUCHIHAH

EPSS

0.69%

48.3th percentile

Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed password of a logged on user and use it in a classic Pass-the-Hash style attack.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wavlink	wn531g3	M31G3.V5030.200325 – M31G3.V5030.200325	—
wavlink	wn531g3_firmware	<= m31g3.v5030.200325	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.