1. Home
  2. CVE Database
  3. CVE-2022-40621
HIGH · 7.5

CVE-2022-40621

Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supp...

Vulnerability Description

Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed password of a logged on user and use it in a classic Pass-the-Hash style attack.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
WavlinkWn531G3 Firmware<= m31g3.v5030.200325
WavlinkWn531G3-

Related Weaknesses (CWE)

CWE-294

References

FAQ

What is CVE-2022-40621?

CVE-2022-40621 is a vulnerability with a CVSS score of 7.5 (HIGH). Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supp...

How severe is CVE-2022-40621?

CVE-2022-40621 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-40621?

Check the references section above for vendor advisories and patch information. Affected products include: Wavlink Wn531G3 Firmware, Wavlink Wn531G3.