HIGH🇬🇧 English

CVE-2022-40622

CVSS 8.8v3.1pub. 2022-09-13upd. 2024-11-21

The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.

oryginał EN
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Wavlink Wn531g3

    HW
    Wavlink
    wszystkie wersje

  • Wavlink Wn531g3 Firmware

    OS
    Wavlink
    ≤ m31g3.v5030.200325
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2022-40621HIGH7.5ten sam produkt

Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates...

CVE-2022-40623HIGH8.8ten sam produkt

The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF token...

CVE-2020-10972HIGH7.5ten sam produkt

An issue was discovered where a page is exposed that has the current administrator password in cleartext in th...

CVE-2020-10973HIGH7.5ten sam produkt

An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /...

CVE-2020-12266HIGH7.5ten sam produkt

An issue was discovered where there are multiple externally accessible pages that do not require any sort of a...