Search
Find a vulnerability
Search criteria
10 vulnerabilities by WAVLINK TECHNOLOGY Ltd.
CVE-2023-32622 (GCVE-0-2023-32622)
Vulnerability from nvd – Published: 2023-06-30 04:04 – Updated: 2024-12-04 16:01
VLAI
Summary
Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Improper neutralization of special elements in output used by a downstream component ('Injection')
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:35.711Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T15:59:11.442502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:01:56.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper neutralization of special elements in output used by a downstream component (\u0027Injection\u0027)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:04:04.451Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32622",
"datePublished": "2023-06-30T04:04:04.451Z",
"dateReserved": "2023-05-11T04:09:38.939Z",
"dateUpdated": "2024-12-04T16:01:56.804Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32621 (GCVE-0-2023-32621)
Vulnerability from nvd – Published: 2023-06-30 04:03 – Updated: 2024-12-04 16:04
VLAI
Summary
WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:36.328Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32621",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T16:02:42.588030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:04:07.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:03:36.732Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32621",
"datePublished": "2023-06-30T04:03:36.732Z",
"dateReserved": "2023-05-11T04:09:45.902Z",
"dateUpdated": "2024-12-04T16:04:07.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32620 (GCVE-0-2023-32620)
Vulnerability from nvd – Published: 2023-06-30 04:02 – Updated: 2024-12-04 16:06
VLAI
Summary
Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper authentication
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:35.706Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T16:05:04.376423Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:06:17.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper authentication",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:02:54.431Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32620",
"datePublished": "2023-06-30T04:02:54.431Z",
"dateReserved": "2023-05-11T04:09:41.364Z",
"dateUpdated": "2024-12-04T16:06:17.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32613 (GCVE-0-2023-32613)
Vulnerability from nvd – Published: 2023-06-30 04:02 – Updated: 2024-12-05 15:21
VLAI
Summary
Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Exposure of resource to wrong sphere
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2_firmware |
Affected:
0 , < 2023526
(custom)
cpe:2.3:o:wavlink:wl-wn531ax2_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:35.667Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-wn531ax2_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2_firmware",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32613",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-05T15:19:59.092393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-05T15:21:58.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Exposure of resource to wrong sphere",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:02:25.928Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32613",
"datePublished": "2023-06-30T04:02:25.928Z",
"dateReserved": "2023-05-11T04:09:48.995Z",
"dateUpdated": "2024-12-05T15:21:58.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32612 (GCVE-0-2023-32612)
Vulnerability from nvd – Published: 2023-06-30 04:01 – Updated: 2024-11-27 15:27
VLAI
Summary
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Client-side enforcement of server-side security
- CWE-565 - Reliance on Cookies without Validation and Integrity Checking
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:36.259Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-27T15:25:42.533576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-565",
"description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T15:27:50.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Client-side enforcement of server-side security",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:01:42.987Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32612",
"datePublished": "2023-06-30T04:01:42.987Z",
"dateReserved": "2023-05-11T04:09:41.401Z",
"dateUpdated": "2024-11-27T15:27:50.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32622 (GCVE-0-2023-32622)
Vulnerability from cvelistv5 – Published: 2023-06-30 04:04 – Updated: 2024-12-04 16:01
VLAI
Summary
Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Improper neutralization of special elements in output used by a downstream component ('Injection')
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:35.711Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T15:59:11.442502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:01:56.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper neutralization of special elements in output used by a downstream component (\u0027Injection\u0027)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:04:04.451Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32622",
"datePublished": "2023-06-30T04:04:04.451Z",
"dateReserved": "2023-05-11T04:09:38.939Z",
"dateUpdated": "2024-12-04T16:01:56.804Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32621 (GCVE-0-2023-32621)
Vulnerability from cvelistv5 – Published: 2023-06-30 04:03 – Updated: 2024-12-04 16:04
VLAI
Summary
WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:36.328Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32621",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T16:02:42.588030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:04:07.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:03:36.732Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32621",
"datePublished": "2023-06-30T04:03:36.732Z",
"dateReserved": "2023-05-11T04:09:45.902Z",
"dateUpdated": "2024-12-04T16:04:07.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32620 (GCVE-0-2023-32620)
Vulnerability from cvelistv5 – Published: 2023-06-30 04:02 – Updated: 2024-12-04 16:06
VLAI
Summary
Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Improper authentication
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:35.706Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T16:05:04.376423Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:06:17.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireless network."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper authentication",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:02:54.431Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32620",
"datePublished": "2023-06-30T04:02:54.431Z",
"dateReserved": "2023-05-11T04:09:41.364Z",
"dateUpdated": "2024-12-04T16:06:17.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32613 (GCVE-0-2023-32613)
Vulnerability from cvelistv5 – Published: 2023-06-30 04:02 – Updated: 2024-12-05 15:21
VLAI
Summary
Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Exposure of resource to wrong sphere
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2_firmware |
Affected:
0 , < 2023526
(custom)
cpe:2.3:o:wavlink:wl-wn531ax2_firmware:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:35.667Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-wn531ax2_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2_firmware",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32613",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-05T15:19:59.092393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-05T15:21:58.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Exposure of resource to wrong sphere",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:02:25.928Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32613",
"datePublished": "2023-06-30T04:02:25.928Z",
"dateReserved": "2023-05-11T04:09:48.995Z",
"dateUpdated": "2024-12-05T15:21:58.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-32612 (GCVE-0-2023-32612)
Vulnerability from cvelistv5 – Published: 2023-06-30 04:01 – Updated: 2024-11-27 15:27
VLAI
Summary
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- Client-side enforcement of server-side security
- CWE-565 - Reliance on Cookies without Validation and Integrity Checking
Assigner
References
2 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| WAVLINK TECHNOLOGY Ltd. | WL-WN531AX2 |
Affected:
firmware versions prior to 2023526
|
|
| wavlink | wl-wn531ax2 |
Affected:
0 , < 2023526
(custom)
cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:25:36.259Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:wavlink:wl-wn531ax2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "wl-wn531ax2",
"vendor": "wavlink",
"versions": [
{
"lessThan": "2023526",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-32612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-27T15:25:42.533576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-565",
"description": "CWE-565 Reliance on Cookies without Validation and Integrity Checking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T15:27:50.171Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WL-WN531AX2",
"vendor": "WAVLINK TECHNOLOGY Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware versions prior to 2023526"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Client-side enforcement of server-side security",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-06-30T04:01:42.987Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.wavlink.com/en_us/firmware/details/932108ffc5.html"
},
{
"url": "https://jvn.jp/en/jp/JVN78634340/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-32612",
"datePublished": "2023-06-30T04:01:42.987Z",
"dateReserved": "2023-05-11T04:09:41.401Z",
"dateUpdated": "2024-11-27T15:27:50.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}