CVE-2022-40622CWE-304

CVE-2022-40622: vulnerability in WAVLINK WN531G3

WAVLINK Quantum D4G (WN531G3) Session Management by IP Address

Published · Updated

Follow this CVE+ Monitor WN531G3

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.7%
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.
Affected products
WAVLINK · WN531G3
Related CVEs — WAVLINK WN531G3

In the same product, most dangerous first.

CVE-2022-40621—WAVLINK Quantum D4G (WN531G3) Pass-The-HashEPSS 0.9%CVE-2022-40623—WAVLINK Quantum D4G (WN531G3) CSRFEPSS 0.7%