CVE-2022-35517

Deeper analysis

CVE-2022-35517 affects multiple WAVLINK router models including WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. The root cause is missing input filtering on the parameters web_pskValue, wl_Method, wlan_ssid, EncrypType, rwan_ip, rwan_mask, rwan_gateway, ppp_username, ppp_passwd, and ppp_setver within adm.cgi, which permits command injection when the /wizard_router_mesh.shtml page is accessed.

An authenticated attacker with network access can supply crafted values for these parameters to execute arbitrary commands on the device. Successful exploitation yields full control over the router, enabling actions such as configuration changes, traffic interception, or persistence, consistent with the CVSS 8.8 rating reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

The associated EPSS score has remained low and stable, with a current value of 0.0490 and a peak of 0.0507. Public references consist of technical write-ups on GitHub that document the injection vectors but contain no vendor advisories, firmware patches, or mitigation guidance.