CVE-2022-40622
8.8
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD
Description
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.
Affected (1)
Products: Wavlink: Wn531g3 Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to m31g3.v5030.200325 |
| Running on/with | Platform Versions |
|---|---|
Wavlink Wn531g3 | All versions |
Related CWEs
CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-304
Missing Critical Step in Authentication
The product implements an authentication technique, but it skips a step that weakens the technique.
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Timeline
No history available yet.