WAVLINK Router internet.cgi IPv6 Parameter Command Injection (CVE-2024-10429)

Key Information 1. Vulnerability Name: - WAVLINK WN530H4/WN530HG4/WN572HG3 UP TO 20221028 INTERNET.CGI SET_IPV6 IPV6OPMODE/IPV6IPADDR/IPV6WANIPADDR/IPV6GWADDR COMMAND INJECTION 2. Vulnerability ID: - CVE-2024-10429 3. Affected Devices: - WAVLINK WN530H4, WN530HG4, and WN572HG3 up to 20221028 4. Vulnerability Description: - The vulnerability resides in the function within the file. - Manipulating the parameters IPv6opMode, IPV6IPAddr, IPV6WANIPAddr, and IPV6GWAddr with unknown input can lead to a command injection vulnerability. - Classified under CWE-77. - The product constructs commands using external influence input, but fails to properly neutralize or neutralizes special elements that may alter commands when sent to downstream components. 5. Impact: - Affects confidentiality, integrity, and availability. 6. CVSS Meta Temp Score: - 6.8 7. Current Exploit Price: - $0-$5k 8. CTI Interest Score: - 1.55 9. Vulnerability Details: - Exploitable via remote attack. - Publicly disclosed and potentially exploitable. - Vendor was notified early but did not respond. 10. Exploit Availability: - Exploit tool available for download via link. - Marked as "proof-of-concept". 11. Reference Links: - docs.google.com Summary This vulnerability is a command injection flaw located in the file of WAVLINK WN530H4/WN530HG4/WN572HG3 devices. By manipulating specific parameters, attackers can remotely execute arbitrary commands. Although the CVSS score is moderate, the potential severity warrants caution.

Goal Reached Thanks to every supporter — we hit 100%!

WAVLINK Router internet.cgi IPv6 Parameter Command Injection (CVE-2024-10429)