CVE-2022-40622: The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens…

PriorityP344high8.8CVSS 3.1

AVAACLPRNUINSUCHIHAH

EPSS

0.70%

48.5th percentile

The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wavlink	wn531g3	M31G3.V5030.200325 – M31G3.V5030.200325	—
wavlink	wn531g3_firmware	<= m31g3.v5030.200325	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.