CVE-2022-34046: wavlink wn533a8_firmware Incorrect Authorization

Vulnerability summary

CVE-2022-34046 is a high (CVSS 7.5) Incorrect Authorization vulnerability in wavlink wn533a8_firmware. EPSS estimates a 21.12% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 20-07-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.