Riskcovery

CVE-2022-40622

WAVLINK Quantum D4G (WN531G3) Session Management by IP Address

State
Published
Severity
Not scored
Published
Sep 13, 2022
Updated
Sep 16, 2024
Reserved
Sep 12, 2022

Read the record on cve.org

Description

The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-304 Missing Critical Step in Authentication

Affected Products

ProductVersions
WN531G3WAVLINK
  • M31G3.V5030.200325 through M31G3.V5030.200325Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.