Login Sign Up

CVE-2022-34577

9.8 CRITICAL
Remote Code Execution

📋 TL;DR

This vulnerability allows unauthenticated attackers to execute arbitrary code on WAVLINK WN535 G3 routers by sending a specially crafted POST request to the adm.cgi endpoint. It affects all users of this specific router model running vulnerable firmware. The high CVSS score indicates critical severity with network-accessible attack vectors.

💻 Affected Systems

Products:
  • WAVLINK WN535 G3
Versions: M35G3R.V5030.180927 and likely earlier versions
Operating Systems: Embedded Linux firmware
Default Config Vulnerable: ⚠️ Yes
Notes: The adm.cgi endpoint appears to be accessible by default in the web administration interface.

📦 What is this software?

Wn535g3 Firmware by Wavlink

View all CVEs affecting Wn535g3 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the router allowing attackers to install persistent backdoors, intercept all network traffic, pivot to internal networks, or brick the device.

🟠

Likely Case

Remote code execution leading to router compromise, credential theft, DNS hijacking, or participation in botnets.

🟢

If Mitigated

Limited impact if device is behind firewall with no external access, though internal threats remain.

🌐 Internet-Facing: HIGH - The vulnerability is remotely exploitable without authentication via HTTP requests.
🏢 Internal Only: HIGH - Even internally, any attacker on the network can exploit this vulnerability.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Public GitHub repository contains proof-of-concept exploit code. The vulnerability requires only HTTP POST requests with crafted parameters.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: Not found in provided references

Restart Required: No

Instructions:

Check WAVLINK official website for firmware updates. If available, download latest firmware and upload via web admin interface under System Tools > Firmware Upgrade.

🔧 Temporary Workarounds

Block Web Admin Access

linux

Restrict access to router web interface using firewall rules

iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

Disable Remote Management

all

Turn off remote administration in router settings

🧯 If You Can't Patch

  • Place router behind a firewall that blocks all inbound HTTP/HTTPS traffic to the device
  • Segment the router on isolated network VLAN to limit lateral movement if compromised

🔍 How to Verify

Check if Vulnerable:

Check firmware version in web admin interface under System Status. If version is M35G3R.V5030.180927 or earlier, assume vulnerable.

Check Version:

curl -s http://router-ip/cgi-bin/adm.cgi | grep -i version

Verify Fix Applied:

Verify firmware version has been updated to a version later than M35G3R.V5030.180927

📡 Detection & Monitoring

Log Indicators:

  • Unusual POST requests to /cgi-bin/adm.cgi
  • Multiple failed authentication attempts followed by successful adm.cgi access
  • Suspicious command execution patterns in system logs

Network Indicators:

  • HTTP POST requests to adm.cgi with unusual parameters
  • Outbound connections from router to suspicious IPs
  • DNS queries to known malicious domains

SIEM Query:

source="router_logs" AND (uri="/cgi-bin/adm.cgi" OR uri="/adm.cgi") AND method="POST"

📊 Metadata

CVE ID: CVE-2022-34577
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: July 25, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON