Aissac

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

**Name of the Vulnerable Software and Affected Versions** EFM ipTIME C200E version 1.094 **Description** An OS command injection flaw exists in the System Setup component of the device. The issue is located within an unknown function of the `iux set.cgi` endpoint. This flaw allows a remote attacker to inject and execute arbitrary operating system commands without authentication by manipulating input supplied to the endpoint. OS command injection is a vulnerability where an application improperly validates input, allowing an attacker to execute system-level commands on the host operating system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Disable internet-facing management. Restrict the management interface to trusted networks. Monitor for unexplained configuration changes and unusual outbound traffic.