Description
A security flaw has been discovered in Wavlink WL-WN579A3 up to 20210219. Affected by this issue is the function DeleteMac of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list results in command injection. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Wavlink | WL-WN579A3 | 20210219 | — |
References
- VDB-346117 | Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection vdb-entry technical-description
- VDB-346117 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #748076 | Wavlink WN579A3 20210219 Command Injection third-party-advisory
- https://github.com/MRAdera/IoT-Vuls/blob/main/wavlink/wn579a3/DeleteMac.md related