CVEvulnerability

CVE-2022-40622

8.8 HIGH Published 2022-09-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-09-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-304

Description

The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.

Affected configurations

• wavlink wn531g3 firmware (<= m31g3.v5030.200325)

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-304 Missing Critical Step in Authentication weakness

References