CVE-2022-40622 Vulnerability Details

  /     /     /  

CVE-2022-40622 Metadata Quick Info

CVE Published: 13/09/2022 | CVE Updated: 16/09/2024 | CVE Year: 2022
Source: rapid7 | Vendor: WAVLINK | Product: WN531G3
Status : PUBLISHED

---

CVE-2022-40622 Description

The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator\'s, or is behind the same NAT as the logged in administrator, session takeover is possible.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-304
CWE Name: CWE-304 Missing Critical Step in Authentication
Source: WAVLINK

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).