Cyber Resilience

CVE-2022-35537

CriticalPublic PoC

Published: 10 August 2022

Published
10 August 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0187 83.5th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-35537 is a critical-severity an unspecified weakness vulnerability in Wavlink Wn572Hp3 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 16.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2022-35537 is a command-injection vulnerability in the wireless.cgi component of several WAVLINK wireless routers, specifically the WN572HP3, WN533A8, WN530H4, WN535G3, and WN531P3 models. The flaw stems from missing input filtering on the mac_5g and Newname parameters, which are processed when the device renders the /wifi_mesh.shtml page.

An unauthenticated attacker with network access can supply crafted values for these parameters to execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, allowing arbitrary code execution with impacts across confidentiality, integrity, and availability.

The associated EPSS score rose from a low baseline to a peak of 0.0876 on 2025-01-22 before receding to its current value of 0.0187, indicating a period of increased exploitation interest well after the original disclosure.

EU & UK References

Vulnerability details

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: mac_5g and Newname, which leads to command injection in page /wifi_mesh.shtml.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

wavlink
wn572hp3 firmware
all versions
wavlink
wn533a8 firmware
all versions
wavlink
wn530h4 firmware
all versions
wavlink
wn535g3 firmware
all versions
wavlink
wn531p3 firmware
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References