CVE-2024-10428 — HIGH (7.2)

Vulnerability Description

A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of the file firewall.cgi. The manipulation of the argument dhcpGateway leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Score

7.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Wavlink	Wn530H4 Firmware	20220721
Wavlink	Wn530H4	-
Wavlink	Wn530Hg4 Firmware	20220809
Wavlink	Wn530Hg4	-
Wavlink	Wn572Hg3 Firmware	20221028
Wavlink	Wn572Hg3	-

Related Weaknesses (CWE)

CWE-77

References

https://docs.google.com/document/d/11NGSJBOZzbgm_qanDno6SyucWyso7Em6/ExploitThird Party Advisory
https://vuldb.com/?ctiid.281969Permissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?id.281969Permissions RequiredThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.427272ExploitThird Party AdvisoryVDB Entry

FAQ

What is CVE-2024-10428?

CVE-2024-10428 is a vulnerability with a CVSS score of 7.2 (HIGH). A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of the file firewall.cgi. The manipulation o...

How severe is CVE-2024-10428?

CVE-2024-10428 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-10428?

Check the references section above for vendor advisories and patch information. Affected products include: Wavlink Wn530H4 Firmware, Wavlink Wn530H4, Wavlink Wn530Hg4 Firmware, Wavlink Wn530Hg4, Wavlink Wn572Hg3 Firmware.