CVE-2022-2486

Deeper analysis

A critical OS command injection vulnerability exists in the WAVLINK WN535K2 and WN535K3 devices, specifically within the /cgi-bin/mesh.cgi?page=upgrade endpoint. The flaw, tracked as CVE-2022-2486 and assigned CWE-78, arises from insufficient sanitization of the "key" parameter, allowing arbitrary command execution. It carries a CVSS 3.1 score of 8.0 reflecting adjacent-network access, low attack complexity, and low privileges required for successful exploitation with high impact on confidentiality, integrity, and availability.

An attacker positioned on the same network segment who can reach the affected CGI script can supply a malicious "key" value to inject and execute operating-system commands. This grants the ability to compromise device configuration, exfiltrate data, or disrupt service without user interaction. Public exploit code has already been released, enabling straightforward reproduction of the attack.

The EPSS score has reached a current value of 0.9012 with a recorded peak of 0.9733, indicating sustained and substantial exploitation interest following disclosure. No vendor advisory or patch information is referenced in the available sources.