CVE-2022-48166
Published: 06 February 2023
Summary
CVE-2022-48166 is a high-severity Missing Authorization (CWE-862) vulnerability in Wavlink Wl-Wn530Hg4 Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-48166 is an access-control vulnerability (CWE-862) affecting the Wavlink WL-WN530HG4 router running firmware version M30HG4.V5030.201217. The flaw permits unauthenticated network access to configuration files and log data that contain administrative credentials, resulting in a CVSS 3.1 score of 7.5.
An attacker with no credentials can retrieve the device configuration and logs over the network, directly obtaining administrator usernames and passwords. Successful exploitation grants the attacker full administrative control of the affected router.
Public disclosures on GitHub and Google Docs describe the issue and reproduction steps but contain no vendor-supplied patches or mitigation guidance. The EPSS score rose from lower values to a peak of 0.7509 before receding to the current 0.6623, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-50877
Vulnerability details
An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.