CVE-2023-3380
MediumCVSS 4.7Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
A critical vulnerability has been identified in the Wavlink WN579X3 device up to version 20230615, concerning an unknown function of the file /cgi-bin/adm.cgi in the Ping Test component. Manipulation of the pingIp argument leads to injection.
Risk Assessment
This vulnerability allows for remote exploitation, posing a significant threat to the organization's security. The public disclosure of the exploit increases the risk of this vulnerability being exploited.
Recommendation
It is recommended to immediately update the device to the latest version to mitigate this vulnerability. Additionally, monitoring network traffic for potential attack attempts is advisable.
Original NVD description (English source)
A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232236. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.