CVE-2022-31846
📋 TL;DR
This vulnerability in WAVLINK WN535 G3 routers allows attackers to execute commands via the live_mfg.shtml endpoint, potentially exposing sensitive router information. Attackers can exploit this to gain unauthorized access to configuration details. Affected users are those running vulnerable firmware versions on these specific router models.
💻 Affected Systems
- WAVLINK WN535 G3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control of the router, intercept network traffic, modify configurations, and potentially pivot to internal network devices.
Likely Case
Attackers extract sensitive router information including credentials, network configurations, and device details, leading to further exploitation.
If Mitigated
With proper network segmentation and access controls, impact is limited to the router itself without lateral movement.
🎯 Exploit Status
The exploit involves simple HTTP requests to the vulnerable endpoint with command execution parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check WAVLINK website for firmware updates
2. If update available, download and apply via router web interface
3. Verify the live_mfg.shtml endpoint is no longer accessible or vulnerable
🔧 Temporary Workarounds
Block access to vulnerable endpoint
linuxUse router firewall rules to block access to /live_mfg.shtml
iptables -A INPUT -p tcp --dport 80 -m string --string "live_mfg.shtml" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "live_mfg.shtml" --algo bm -j DROP
Disable web interface from WAN
allConfigure router to only allow web interface access from LAN
🧯 If You Can't Patch
- Isolate affected routers in separate network segments with strict firewall rules
- Implement network monitoring for unusual access to router management interfaces
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[router-ip]/live_mfg.shtml?cmd=ls or similar command executionCheck Version:
Check router web interface or use: curl -s http://[router-ip]/ | grep -i firmwareVerify Fix Applied:
Verify the endpoint no longer responds or returns error for command execution attempts📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /live_mfg.shtml with cmd parameter
- Unusual command execution in router logs
Network Indicators:
- HTTP traffic to router IP on port 80/443 containing 'live_mfg.shtml' and 'cmd='
SIEM Query:
source="router_logs" AND uri="/live_mfg.shtml" AND query="*cmd=*"