CVEvulnerability

CVE-2024-48705

6.5 MEDIUM Published 2025-09-02 Modified 2026-07-05 Official page ↗
Status
Modified
Published
2025-09-02
Last modified
2026-07-05
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-77

Description

Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "set_sys_adm" function of the "adm.cgi" binary, and is due to improper santization of the user provided "newpass" field

Affected configurations

• wavlink wl-wn531p3 firmware m32a3 v1410 230602 • wavlink wl-wn531p3 firmware m32a3 v1410 240222

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References