Slew of WavLink vulnerabilities

Slew of WavLink vulnerabilities

/in

Slew of WavLink vulnerabilities

Lilith >_> of Cisco Talos discovered these vulnerabilities. 

Forty-four vulnerabilities and sixty-three CVEs were discovered across ten .cgi and three .sh files, as well as the static login page, of the Wavlink AC3000 wireless router web application.  

The Wavlink AC3000 wireless router is one of the most popular gigabit routers in the US, in part due to both its potential speed capabilities and low price point. 

Talos is releasing these advisories in accordance with Cisco’s third-party vulnerability disclosure policy. Wavlink has declined to release a patch for these vulnerabilities.  

For Snort coverage that can detect the exploitation of these vulnerabilities, download the latest rule sets from Snort.org, and our latest Vulnerability Advisories are always posted on Talos Intelligence’s website.   

Static login vulnerability 

An attacker can send a specially crafted set of network packets over WAN to gain root access to the router via the wcrtrl service and static login credentials.  

Static Login 

Ten .cgi vulnerabilities 

An unauthenticated HTTP request can trigger the following types of vulnerabilities: 

touchlist_sync.cgi 

Login.cgi 

internet.cgi 

firewall.cgi 

adm.cgi 

wireless.cgi 

usbip.cgi 

qos.cgi 

openvpn.cgi 

nas.cgi 

Three .sh vulnerabilities 

Attackers can send specially crafted HTTP requests. A man-in-the-middle attack can trigger the fw_check.sh and update_filter_url.sh vulnerabilities. 

testsave.sh 

fw_check.sh 

update_filter_url.sh 

 

Cisco Talos Blog – ​Read More