This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: OS Command Injection in WAVLINK routers. ๐ **Consequences**: Attackers can execute arbitrary commands, steal data, modify system files, or take full control of the device without credentials.โฆ
๐ก๏ธ **Root Cause**: CWE-78 (OS Command Injection). ๐ **Flaw**: The `/cgi-bin/touchlist_sync.cgi` script fails to properly sanitize the `IP` parameter. Malicious input is passed directly to the OS shell.
Q3Who is affected? (Versions/Components)
๐ฆ **Affected Products**: WAVLINK WN535K2 and WN535K3 wireless routers. ๐ญ **Vendor**: WAVLINK (China). โ ๏ธ **Scope**: Specific firmware versions handling the `touchlist_sync` feature are vulnerable.
Q4What can hackers do? (Privileges/Data)
๐ **Hacker Powers**: Full system control! ๐ **Data**: Access sensitive info. ๐ **Actions**: Execute malware, modify data, or gain root access. No authentication is required for the initial exploit.
Q5Is exploitation threshold high? (Auth/Config)
๐ **Auth Required**: Local Network (AV:A). ๐ **Privileges**: Low (PR:L). ๐ฏ **Complexity**: Low (AC:L). You need to be on the same local network, but no password is needed to trigger the injection via the CGI endpoint.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฅ **Public Exploit**: YES. ๐ **PoC**: Available via Nuclei templates (projectdiscovery). ๐ **Status**: Active exploitation is possible using known scripts targeting the `IP` argument in the CGI script.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for `/cgi-bin/touchlist_sync.cgi`. ๐ก **Tool**: Use Nuclei or custom scripts to send a malicious `IP` payload.โฆ
๐ฉน **Official Fix**: Check WAVLINK support for firmware updates. ๐ **Published**: July 20, 2022. ๐ **Action**: Update to the latest patched firmware immediately if available. The vendor has acknowledged the issue.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: Isolate the router! ๐ซ **Network**: Block external access to the management interface.โฆ
๐จ **Urgency**: HIGH! ๐ด **Priority**: Critical. CVSS Score is High (H/H/H). โก **Reason**: Easy to exploit, no auth needed, and leads to full compromise. Patch or isolate immediately.