CVE-2022-35520

Deeper analysis

CVE-2022-35520 affects multiple WAVLINK router models including WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. The api.cgi endpoint accepts an unfiltered ufconf parameter that does not appear in normal POST requests yet exists in the compiled CGI binary; supplying attacker-controlled input to this hidden parameter on the /ledonoff.shtml page results in unauthenticated command injection.

An attacker with network access can send a crafted request that bypasses any visible form validation and executes arbitrary commands on the device. Successful exploitation grants full control over the router, enabling actions consistent with the CVSS 9.8 rating of complete confidentiality, integrity, and availability impact without requiring authentication or user interaction.

Public references consist of technical write-ups hosted on GitHub that document the hidden parameter and reproduction steps; no vendor advisory or firmware patch information is referenced in the available sources.

EPSS scores for the vulnerability rose from a low baseline to a recorded peak of 0.0876, indicating measurable post-disclosure exploitation interest.