CVE-2022-35521

Deeper analysis

CVE-2022-35521 affects multiple WAVLINK router models including WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. The flaw resides in firewall.cgi, which processes the parameters remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilterEnabled, and blockSynFloodEnabled on the /man_security.shtml page without any input filtering or sanitization, enabling unauthenticated command injection.

An attacker with network access to the device can supply crafted values for these parameters to execute arbitrary commands on the router. Because the CVSS vector indicates an attack can be launched remotely with no authentication or user interaction required, successful exploitation yields full control over device configuration and traffic handling.

The two provided references consist of the same technical write-up documenting the injection vectors but contain no vendor advisory, firmware update, or mitigation guidance. The EPSS score rose from a low baseline to a recorded peak of 0.0876, indicating that exploitation interest increased after public disclosure.