Skip to main content

Wn531P3 Firmware CVE-2024-54747

CRITICAL
Incorrect Default Permissions (CWE-276)
2024-12-06 cve@mitre.org
Privilege Escalation Wn531P3 Firmware
9.8
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 06, 2024 - 16:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.

AnalysisAI

WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. Affected products include: Wavlink Wn531P3 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.

More in Wn531P3 Firmware

View all
CVE-2022-35538 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: delete_list, delete_al
CVE-2022-35537 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: mac_5g and Newname, wh
CVE-2022-35536 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qos_bandwith and qos_dat, w
CVE-2022-35535 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter macAddr, which leads to

CVE-2022-35534 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter hiddenSSID32g and SSID2G
CVE-2022-35533 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: cli_list and cli_num, which
CVE-2022-35526 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command
CVE-2022-35525 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameter led_switch, which leads to co
CVE-2022-35524 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: wlan_signal, web_pskValue,

CVE-2022-35523 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter del_mac and parameter fl
CVE-2022-35522 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: ppp_username, ppp_passwd, r
CVE-2022-35521 CRITICAL POC
9.8 Aug 10

WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnable

Same weakness CWE-276 – Incorrect Default Permissions

View all
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-11610 HIGH POC
8.8
CVE-2022-22948 MEDIUM POC
6.5
CVE-2017-8625 HIGH POC
8.8
CVE-2016-5425 HIGH POC
7.8
CVE-2024-55215 CRITICAL POC
9.8
CVE-2024-57604 CRITICAL POC
9.8
CVE-2025-60262 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2024-54747 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy