CVE-2022-2488CWE-78

WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection

High · published July 20, 2022

CVSS v3.1

8.0

EPSS

33%

Percentile

98.4

In the wild

Unconfirmed

What it is

A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used.

The record

Technical detail

CVSS v3.1: 8.0 · HIGH
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.33411 · 98.4th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2022-07-20T11:35Z

EPSS history

Timeline

20 JUL 11:35Z
WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection
cvelistv5