CVE-2022-2488

Name of the Vulnerable Software and Affected Versions WAVLINK WN535K2 WAVLINK WN535K3

Description A critical issue affects the unknown processing of the file /cgi-bin/touchlist sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used.

Recommendations For WAVLINK WN535K2, as a temporary workaround, consider restricting access to the /cgi-bin/touchlist sync.cgi file until a patch is available. For WAVLINK WN535K3, as a temporary workaround, consider restricting access to the /cgi-bin/touchlist sync.cgi file until a patch is available. Avoid using the argument IP in the affected API endpoint until the issue is resolved.