CVE-2022-2486

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
WAVLINK	WN535K2	n/a
WAVLINK	WN535K3	n/a

References

https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20mesh.cgi.mdExploit, Third Party Advisory
https://vuldb.com/?id.204537Third Party Advisory
https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20mesh.cgi.mdExploit, Third Party Advisory
https://vuldb.com/?id.204537Third Party Advisory

Timeline

Published: Jul 20, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248609.8Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key CVE-2022-248618.8Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability.CVE-2022-248627.7Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerab CVE-2022-248637.5http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger pri CVE-2022-248645.4Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript CVE-2022-248656.5HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator m CVE-2022-248664.3Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the Use CVE-2022-248677.5GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. CVE-2022-248685.4GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. CVE-2022-248695.4GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. CVE-2022-24879.8A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the fil CVE-2022-248705.4Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script can be injected in to