Vulnerability record · CVE-2022-40621 · published 13 September 2022
CVE-2022-40621: Wavlink wn531g3 firmware authentication bypass by capture-replay vulnerability
Wavlink · Wn531g3 Firmware
Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed password of a logged on user and use it in a classic Pass-the-Hash style attack.
Description
Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed password of a logged on user and use it in a classic Pass-the-Hash style attack.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.malbytes.net/2022/07/wavlink-quantum-d4g-zero-day-part-01.html | ExploitThird Party Advisory |
| https://www.malbytes.net/2022/07/wavlink-quantum-d4g-zero-day-part-01.html | ExploitThird Party Advisory |
Track CVE-2022-40621 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-40621), CISA KEV, FIRST EPSS (scores of 2026-10-18). This page is refreshed as NVD updates the record.
