CVE-2022-35524

Deeper analysis

CVE-2022-35524 is a command-injection vulnerability affecting the adm.cgi endpoint on several WAVLINK wireless router models, specifically WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3. The flaw stems from missing input validation on the parameters wlan_signal, web_pskValue, sel_EncrypTyp, sel_Automode, wlan_bssid, wlan_ssid, and wlan_channel, allowing unsanitized values to reach the /wizard_rep.shtml page and execute arbitrary operating-system commands.

An unauthenticated attacker with network access can supply crafted values to these parameters and obtain remote code execution. Successful exploitation grants full control over the device, enabling arbitrary command execution with impacts on confidentiality, integrity, and availability, consistent with the CVSS 9.8 rating.

Public references consist of a GitHub repository that documents the injection vectors through proof-of-concept details but contain no vendor advisory, firmware patch, or mitigation guidance.

The associated EPSS score reached a peak of 0.0802 after disclosure before settling at the current value of 0.0503, indicating a measurable increase in observed exploitation interest following publication.