WAVLINK Router firewall.cgi Command Injection Vulnerability (CVE-2024-10428)

Key Information Product Name: WAVLINK WN530H4/WN530HG4/WN572HG3 Vulnerability Description: Vulnerability Type: Command Injection Affected Versions: From 20221028 to 20221028 Affected File: firewall.cgi Affected Function: set_ipv6 Affected Parameter: dhcpGateway Impact: This vulnerability allows attackers to execute arbitrary commands via command injection, potentially compromising the system's security, integrity, and availability. Vulnerability Rating: CVSS Meta Temp Score: 6.8 Vulnerability Price: Current Vulnerability Price: $0-$5k CTI Interest Score: CTI Interest Score: 1.54 Vulnerability Details: Description: This vulnerability allows attackers to execute arbitrary commands via command injection, potentially compromising the system's security, integrity, and availability. Impact: This vulnerability allows attackers to execute arbitrary commands via command injection, potentially compromising the system's security, integrity, and availability. Vulnerability Disclosure: Disclosure Date: 20221028 Disclosure Status: Public Disclosure Source: docs.google.com Vulnerability ID: CVE-2024-10428 Exploitability: Exploit Difficulty: Easy Exploit Method: Remote Required Privileges: Additional authentication level required Technical Details: Known Public Exploit: Known MITRE ATT&CK Technique: T1202 - Valid Accounts Exploit Tools: Exploit Tool: Known Exploit Tool Source: docs.google.com Exploit Tool Type: Proof of Concept Recommended Actions: Recommendation: Replace affected products. Copyright Information: Copyright: 1997-2024 vuldb.com, CC BY-NC-SA

Goal Reached Thanks to every supporter — we hit 100%!

WAVLINK Router firewall.cgi Command Injection Vulnerability (CVE-2024-10428)