CVE-2022-34576
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code on WAVLINK WN535 G3 routers by sending a specially crafted POST request to the /cgi-bin/ExportAllSettings.sh endpoint. Attackers can potentially take full control of affected devices. This affects all users of vulnerable WAVLINK WN535 G3 routers.
💻 Affected Systems
- WAVLINK WN535 G3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept traffic, modify configurations, install persistent malware, and pivot to internal networks.
Likely Case
Router takeover leading to network surveillance, DNS hijacking, credential theft, and denial of service.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Exploitation requires sending a crafted POST request to a specific CGI script; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check WAVLINK website for firmware updates. If available, download and install via router admin interface.
🔧 Temporary Workarounds
Block CGI Script Access
linuxUse firewall rules to block access to /cgi-bin/ExportAllSettings.sh endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/cgi-bin/ExportAllSettings.sh" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/cgi-bin/ExportAllSettings.sh" --algo bm -j DROP
Disable Web Interface
allDisable router web administration interface if not needed
Check router admin interface for option to disable web management
🧯 If You Can't Patch
- Place router behind a firewall with strict inbound filtering
- Implement network segmentation to isolate router from critical systems
🔍 How to Verify
Check if Vulnerable:
Check if router responds to POST requests at http://[router-ip]/cgi-bin/ExportAllSettings.shCheck Version:
Check router admin interface under System Status or Firmware VersionVerify Fix Applied:
Verify the endpoint no longer processes POST requests or returns error📡 Detection & Monitoring
Log Indicators:
- POST requests to /cgi-bin/ExportAllSettings.sh
- Unusual process execution in router logs
Network Indicators:
- POST requests to router IP on port 80/443 with ExportAllSettings.sh in URI
SIEM Query:
source="router_logs" AND uri="/cgi-bin/ExportAllSettings.sh" AND method="POST"