CVE-2022-40622 - CVE House
Back to Database
Status published High CVE-2022-40622

WAVLINK Quantum D4G (WN531G3) Session Management by IP Address

Vulnerability Description

The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator, session takeover is possible.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-40622

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Corey Hartman

References

More from WAVLINK

View All →
CVE-2025-5408
WAVLINK WL-WN576K1 HTTP POST Request login.cgi sys_login buffer overflow
Critical 9.3
CVE-2024-10429
WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set_ipv6 command injection
High 8.6
CVE-2024-10428
WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set_ipv6 command injection
High 8.6
CVE-2024-10194
WAVLINK WN530H4/WN530HG4/WN572HG3 Front-End Authentication Page login.cgi Goto_chidx stack-based overflow
High 8.7
CVE-2024-10193
WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping_ddns command injection
Medium 5.1

Affected Vendor

Affected Software

WN531G3
Vulnerable Versions:
M31G3.V5030.200325

Timeline

Official Publish: September 13th, 2022
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-304

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.