Search
Find a vulnerability
Search criteria
9 vulnerabilities found for wl-wn531ax2 by wavlink
VAR-202306-1966
Vulnerability from variot - Updated: 2025-06-06 23:10Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network. None. WAVLINK WL-WN531AX2 is a wireless router from China's WAVLINK company.
WAVLINK WL-WN531AX2 has an authorization vulnerability, which is caused by incorrect authentication issues
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202306-1966",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wl-wn531ax2",
"scope": "lt",
"trust": 1.6,
"vendor": "wavlink",
"version": "2023526"
},
{
"model": "wl-wn531ax2",
"scope": "eq",
"trust": 0.8,
"vendor": "wavlink",
"version": null
},
{
"model": "wl-wn531ax2",
"scope": "lt",
"trust": 0.8,
"vendor": "wavlink",
"version": "firmware 2023526 earlier"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11452"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "NVD",
"id": "CVE-2023-32620"
}
]
},
"cve": "CVE-2023-32620",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 3.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2023-000065",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2025-11452",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2023-32620",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 6.5,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2023-000065",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-32620",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2025-11452",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202306-1965",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11452"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1965"
},
{
"db": "NVD",
"id": "CVE-2023-32620"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network. None. WAVLINK WL-WN531AX2 is a wireless router from China\u0027s WAVLINK company. \n\nWAVLINK WL-WN531AX2 has an authorization vulnerability, which is caused by incorrect authentication issues",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-32620"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNVD",
"id": "CNVD-2025-11452"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-32620",
"trust": 3.8
},
{
"db": "JVN",
"id": "JVN78634340",
"trust": 2.4
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065",
"trust": 2.0
},
{
"db": "CNVD",
"id": "CNVD-2025-11452",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1965",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11452"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1965"
},
{
"db": "NVD",
"id": "CVE-2023-32620"
}
]
},
"id": "VAR-202306-1966",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11452"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11452"
}
]
},
"last_update_date": "2025-06-06T23:10:45.321000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Firmware\u00a0Details\u00a0and\u00a0Download\u00a0|\u00a0Download\u00a0for\u00a0WL-WN531AX2",
"trust": 0.8,
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"title": "Patch for WAVLINK WL-WN531AX2 Authorization Issue Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/694256"
},
{
"title": "WAVLINK WL-WN531AX2 Remediation measures for authorization problem vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=244711"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11452"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1965"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.0
},
{
"problemtype": "Inappropriate authentication (CWE-287) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " others (CWE-Other) [IPA evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "NVD",
"id": "CVE-2023-32620"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://jvn.jp/en/jp/jvn78634340/"
},
{
"trust": 1.6,
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"trust": 1.2,
"url": "https://jvndb.jvn.jp/en/contents/2023/jvndb-2023-000065.html"
},
{
"trust": 0.8,
"url": "https://jvn.jp/jp/jvn78634340/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32612"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32613"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32620"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32621"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32622"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-32620/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11452"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1965"
},
{
"db": "NVD",
"id": "CVE-2023-32620"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2025-11452"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1965"
},
{
"db": "NVD",
"id": "CVE-2023-32620"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-11452"
},
{
"date": "2023-06-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"date": "2023-06-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-1965"
},
{
"date": "2023-06-30T05:15:09.567000",
"db": "NVD",
"id": "CVE-2023-32620"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-11452"
},
{
"date": "2024-05-23T07:11:00",
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"date": "2023-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-1965"
},
{
"date": "2023-07-06T23:39:14.747000",
"db": "NVD",
"id": "CVE-2023-32620"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-1965"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WAVLINK\u00a0 Made \u00a0WL-WN531AX2\u00a0 Multiple vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-1965"
}
],
"trust": 0.6
}
}
VAR-202306-1965
Vulnerability from variot - Updated: 2025-06-06 23:10WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege. None. WAVLINK WL-WN531AX2 is a wireless router from China's WAVLINK company.
WAVLINK WL-WN531AX2 has a code problem vulnerability, which is caused by a file upload vulnerability
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202306-1965",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wl-wn531ax2",
"scope": "lt",
"trust": 1.6,
"vendor": "wavlink",
"version": "2023526"
},
{
"model": "wl-wn531ax2",
"scope": "eq",
"trust": 0.8,
"vendor": "wavlink",
"version": null
},
{
"model": "wl-wn531ax2",
"scope": "lt",
"trust": 0.8,
"vendor": "wavlink",
"version": "firmware 2023526 earlier"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11451"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "NVD",
"id": "CVE-2023-32621"
}
]
},
"cve": "CVE-2023-32621",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "Single",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 5.5,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2023-000065",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:S/C:N/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "MULTIPLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.4,
"id": "CNVD-2025-11451",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.2,
"id": "CVE-2023-32621",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.5,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2023-000065",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "High",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2023-32621",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2025-11451",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202306-1963",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11451"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1963"
},
{
"db": "NVD",
"id": "CVE-2023-32621"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege. None. WAVLINK WL-WN531AX2 is a wireless router from China\u0027s WAVLINK company. \n\nWAVLINK WL-WN531AX2 has a code problem vulnerability, which is caused by a file upload vulnerability",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-32621"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNVD",
"id": "CNVD-2025-11451"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-32621",
"trust": 3.8
},
{
"db": "JVN",
"id": "JVN78634340",
"trust": 2.4
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065",
"trust": 2.0
},
{
"db": "CNVD",
"id": "CNVD-2025-11451",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1963",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11451"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1963"
},
{
"db": "NVD",
"id": "CVE-2023-32621"
}
]
},
"id": "VAR-202306-1965",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11451"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11451"
}
]
},
"last_update_date": "2025-06-06T23:10:45.290000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Firmware\u00a0Details\u00a0and\u00a0Download\u00a0|\u00a0Download\u00a0for\u00a0WL-WN531AX2",
"trust": 0.8,
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"title": "Patch for WAVLINK WL-WN531AX2 code issue vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/694251"
},
{
"title": "WAVLINK WL-WN531AX2 Fixes for code issue vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=244709"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11451"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1963"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-434",
"trust": 1.0
},
{
"problemtype": "Inappropriate authentication (CWE-287) [IPA evaluation ]",
"trust": 0.8
},
{
"problemtype": " others (CWE-Other) [IPA evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "NVD",
"id": "CVE-2023-32621"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "https://jvn.jp/en/jp/jvn78634340/"
},
{
"trust": 1.6,
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"trust": 1.2,
"url": "https://jvndb.jvn.jp/en/contents/2023/jvndb-2023-000065.html"
},
{
"trust": 0.8,
"url": "https://jvn.jp/jp/jvn78634340/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32612"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32613"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32620"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32621"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-32622"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2023-32621/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2025-11451"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1963"
},
{
"db": "NVD",
"id": "CVE-2023-32621"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2025-11451"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"db": "CNNVD",
"id": "CNNVD-202306-1963"
},
{
"db": "NVD",
"id": "CVE-2023-32621"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-11451"
},
{
"date": "2023-06-27T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"date": "2023-06-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-1963"
},
{
"date": "2023-06-30T05:15:09.617000",
"db": "NVD",
"id": "CVE-2023-32621"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2025-06-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2025-11451"
},
{
"date": "2024-05-23T07:11:00",
"db": "JVNDB",
"id": "JVNDB-2023-000065"
},
{
"date": "2023-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202306-1963"
},
{
"date": "2023-07-06T23:39:27.227000",
"db": "NVD",
"id": "CVE-2023-32621"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-1963"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "WAVLINK\u00a0 Made \u00a0WL-WN531AX2\u00a0 Multiple vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-000065"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202306-1963"
}
],
"trust": 0.6
}
}
CVE-2023-32622 (GCVE-0-2023-32622)
Vulnerability from nvd – Published: 2023-06-30 04:04 – Updated: 2024-12-04 16:01
VLAI
EPSS
VEX
Summary
Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-04 15:59 UTC
CWE
- Improper neutralization of special elements in output used by a downstream component ('Injection')
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:35.711Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T15:59:11.442502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:01:56.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper neutralization of special elements in output used by a downstream component (\u0027Injection\u0027)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:04:04.451Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32622",
"datePublished": "2023-06-30T04:04:04.451Z",
"dateReserved": "2023-05-11T04:09:38.939Z",
"dateUpdated": "2024-12-04T16:01:56.804Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32621 (GCVE-0-2023-32621)
Vulnerability from nvd – Published: 2023-06-30 04:03 – Updated: 2024-12-04 16:04
VLAI
EPSS
VEX
Summary
WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-04 16:02 UTC
CWE
- Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:36.328Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32621",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T16:02:42.588030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:04:07.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:03:36.732Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32621",
"datePublished": "2023-06-30T04:03:36.732Z",
"dateReserved": "2023-05-11T04:09:45.902Z",
"dateUpdated": "2024-12-04T16:04:07.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32612 (GCVE-0-2023-32612)
Vulnerability from nvd – Published: 2023-06-30 04:01 – Updated: 2024-11-27 15:27
VLAI
EPSS
VEX
Summary
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-27 15:25 UTC
CWE
- Client-side enforcement of server-side security
- CWE-565 - Reliance on Cookies without Validation and Integrity Checking
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:36.259Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-27T15:25:42.533576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-565",
"description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T15:27:50.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Client-side enforcement of server-side security",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:01:42.987Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32612",
"datePublished": "2023-06-30T04:01:42.987Z",
"dateReserved": "2023-05-11T04:09:41.401Z",
"dateUpdated": "2024-11-27T15:27:50.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32622 (GCVE-0-2023-32622)
Vulnerability from cvelistv5 – Published: 2023-06-30 04:04 – Updated: 2024-12-04 16:01
VLAI
EPSS
VEX
Summary
Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-04 15:59 UTC
CWE
- Improper neutralization of special elements in output used by a downstream component ('Injection')
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:35.711Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T15:59:11.442502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:01:56.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper neutralization of special elements in output used by a downstream component (\u0027Injection\u0027)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:04:04.451Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32622",
"datePublished": "2023-06-30T04:04:04.451Z",
"dateReserved": "2023-05-11T04:09:38.939Z",
"dateUpdated": "2024-12-04T16:01:56.804Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32621 (GCVE-0-2023-32621)
Vulnerability from cvelistv5 – Published: 2023-06-30 04:03 – Updated: 2024-12-04 16:04
VLAI
EPSS
VEX
Summary
WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-04 16:02 UTC
CWE
- Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:36.328Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32621",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T16:02:42.588030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:04:07.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:03:36.732Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32621",
"datePublished": "2023-06-30T04:03:36.732Z",
"dateReserved": "2023-05-11T04:09:45.902Z",
"dateUpdated": "2024-12-04T16:04:07.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32612 (GCVE-0-2023-32612)
Vulnerability from cvelistv5 – Published: 2023-06-30 04:01 – Updated: 2024-11-27 15:27
VLAI
EPSS
VEX
Summary
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-27 15:25 UTC
CWE
- Client-side enforcement of server-side security
- CWE-565 - Reliance on Cookies without Validation and Integrity Checking
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:36.259Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-27T15:25:42.533576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-565",
"description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T15:27:50.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Client-side enforcement of server-side security",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:01:42.987Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32612",
"datePublished": "2023-06-30T04:01:42.987Z",
"dateReserved": "2023-05-11T04:09:41.401Z",
"dateUpdated": "2024-11-27T15:27:50.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
JVNDB-2023-000065
Vulnerability from jvndb - Published: 2023-06-27 07:50 - Updated:2023-06-27 07:50
Severity
Summary
Multiple vulnerabilities in WAVLINK WL-WN531AX2
Details
WL-WN531AX2 provided by WAVLINK contains multiple vulnerabilities listed below.
* Client-side enforcement of server-side security (CWE-602) - CVE-2023-32612
* Exposure of resource to wrong sphere (CWE-668) - CVE-2023-32613
* Improper authentication (CWE-287) - CVE-2023-32620
* Unrestricted upload of file with dangerous type (CWE-434) - CVE-2023-32621
* Improper neutralization of special elements (CWE-138) - CVE-2023-32622
Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000065.html",
"dc:date": "2023-06-27T16:50+09:00",
"dcterms:issued": "2023-06-27T16:50+09:00",
"dcterms:modified": "2023-06-27T16:50+09:00",
"description": "WL-WN531AX2 provided by WAVLINK contains multiple vulnerabilities listed below.\r\n\r\n* Client-side enforcement of server-side security (CWE-602) - CVE-2023-32612\r\n* Exposure of resource to wrong sphere (CWE-668) - CVE-2023-32613\r\n* Improper authentication (CWE-287) - CVE-2023-32620\r\n* Unrestricted upload of file with dangerous type (CWE-434) - CVE-2023-32621\r\n* Improper neutralization of special elements (CWE-138) - CVE-2023-32622\r\n\r\nCyber Defense Institute, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-000065.html",
"sec:cpe": {
"#text": "cpe:/o:wavlink:wl-wn531ax2_firmware",
"@product": "WL-WN531AX2",
"@vendor": "WAVLINK",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "7.7",
"@severity": "High",
"@type": "Base",
"@vector": "AV:A/AC:L/Au:S/C:C/I:C/A:C",
"@version": "2.0"
},
{
"@score": "6.8",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2023-000065",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN78634340/index.html",
"@id": "JVN#78634340",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-32612",
"@id": "CVE-2023-32612",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-32613",
"@id": "CVE-2023-32613",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-32620",
"@id": "CVE-2023-32620",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-32621",
"@id": "CVE-2023-32621",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2023-32622",
"@id": "CVE-2023-32622",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-32612",
"@id": "CVE-2023-32612",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-32613",
"@id": "CVE-2023-32613",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-32620",
"@id": "CVE-2023-32620",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-32621",
"@id": "CVE-2023-32621",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-32622",
"@id": "CVE-2023-32622",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-287",
"@title": "Improper Authentication(CWE-287)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple vulnerabilities in WAVLINK WL-WN531AX2"
}