What’s Vulnerable › Vulnerabilities

CVE-2022-40621: WAVLINK Quantum D4G (WN531G3) Pass-The-Hash

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-13 · updated 2026-06-17
• Weakness: CWE-294

Description

Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient network access to capture the hashed password of a logged on user and use it in a classic Pass-the-Hash style attack.

Affected products

• WAVLINK WN531G3: through m31g3.v5030.200325

References

• https://www.malbytes.net/2022/07/wavlink-quantum-d4g-zero-day-part-01.html
• https://www.malbytes.net/2022/07/wavlink-quantum-d4g-zero-day-part-01.html

Get alerted when CVE-2022-40621 or the next vulnerability affects your stack