CVE-2022-2487

What it actually does

The flaw is an unauthenticated operating system command injection vulnerability in the WAVLINK WN535K2 and WN535K3 router web management interface, specifically the /cgi-bin/nightled.cgi endpoint. User-controlled input supplied through the start_hour parameter is passed to an operating system command without adequate validation or escaping, allowing a remote attacker to append shell metacharacters and execute arbitrary commands with the privileges of the web service, which on embedded routers is often highly privileged. Successful exploitation can enable full device compromise, configuration theft, traffic interception, malware installation, botnet enrollment, persistence changes, or denial of service.

Why it matters to the business

Compromise of affected WAVLINK routers can give attackers control of network edge devices, allowing them to disrupt connectivity, redirect or monitor traffic, weaken network security, or use the device as a foothold for attacks against internal systems. The risk is elevated because exploitation is remote, requires no authentication or user interaction, has a critical CVSS score, has weaponized public exploit code, and has a high EPSS likelihood of exploitation. Although it is not currently listed in the CISA KEV catalog and is not specifically flagged as ransomware-associated, exposed devices should be treated as high-priority because consumer and small-office routers are commonly targeted for botnets and proxy infrastructure.

How an attack unfolds

An attacker first identifies an internet-exposed WAVLINK WN535K2 or WN535K3 router with the web management CGI interface reachable. The attacker sends a crafted HTTP request to /cgi-bin/nightled.cgi containing shell metacharacters or command separators in the start_hour parameter. Because the firmware fails to safely validate the parameter before using it in an operating system command, the injected payload is interpreted by the underlying shell. The attacker can then run commands to enumerate the device, download and execute malware, modify startup scripts or configuration, add firewall or DNS changes, disable services, or pivot through the router. In common router exploitation patterns, the attacker may use curl, wget, tftp, busybox, or shell redirection to stage binaries for the device architecture and join the router to a botnet or proxy network.

How to fix it

Upgrade affected WAVLINK WN535K2 and WN535K3 firmware to a vendor-provided version that removes the command injection flaw, if one is available from the manufacturer. No fixed versions were provided in the supplied advisory data, so organizations should verify firmware availability directly with WAVLINK and replace unsupported devices if no patched firmware exists. Until remediation is complete, disable remote administration from the internet, restrict web management access to trusted management networks only, place the device behind a firewall or upstream router, block inbound access to the management interface, and change administrative credentials after patching or replacement. If compromise is suspected, perform a factory reset, reinstall known-good firmware, review DNS/firewall/port-forwarding settings, rotate any credentials that may have traversed the device, and consider device replacement because embedded device persistence can be difficult to verify.

How to confirm the fix worked

Confirm whether WAVLINK WN535K2 or WN535K3 devices are present and identify their firmware versions through administrative interfaces, asset inventory, network scans, or physical inspection. Validate that the web management interface is not reachable from untrusted networks, especially the internet. Check externally that /cgi-bin/nightled.cgi is not accessible from public IP space. After applying a firmware update or replacing the device, retest the endpoint with a harmless payload containing command separators in the start_hour parameter and confirm that the input is rejected, sanitized, or does not result in command execution. Review device configuration for unexpected DNS servers, port forwards, firewall rules, startup commands, unknown users, or unexplained remote-management settings.

Typical attack path

1. Scan the internet or target address ranges for WAVLINK WN535K2/WN535K3 web administration interfaces.
2. Confirm the presence of the vulnerable CGI endpoint /cgi-bin/nightled.cgi.
3. Send a crafted request where the start_hour parameter contains shell command separators or metacharacters.
4. Execute a benign test command such as id, uname, or echo to confirm command execution.
5. Download or write a payload using wget, curl, tftp, busybox, or shell redirection.
6. Execute the payload or modify device settings to maintain control.
7. Use the compromised router for traffic proxying, botnet activity, DNS manipulation, reconnaissance, or attacks against adjacent systems.

How to detect it

Review HTTP access logs, reverse proxy logs, firewall logs, IDS/IPS alerts, and packet captures for requests to /cgi-bin/nightled.cgi where the start_hour parameter contains shell metacharacters, encoded command separators, or common command names. Look for URL-encoded characters such as %3B, %7C, %26, %60, %24%28, newline encodings, or suspicious strings such as wget, curl, tftp, busybox, chmod, sh, /bin/sh, nc, telnetd, rm -rf, uname, id, or echo in the parameter value. On the device, if shell or diagnostic access is available, inspect temporary directories, startup scripts, crontab locations, web directories, and configuration backups for unfamiliar binaries or commands. Network telemetry should be reviewed for unusual outbound connections from the router shortly after suspicious web requests, especially downloads over HTTP/TFTP, connections to high-risk hosting providers, repeated scanning, proxy-like behavior, or DNS changes. Because embedded routers often have limited logging, absence of logs does not rule out exploitation; exposed vulnerable devices should be presumed at elevated risk and reset or replaced if compromise cannot be confidently excluded.

• /cgi-bin/nightled.cgi
• start_hour=
• start_hour=*;*
• start_hour=*%3B*
• start_hour=*|*
• start_hour=*%7C*
• start_hour=*&*
• start_hour=*%26*
• start_hour=*`*
• start_hour=*%60*
• start_hour=*$(*)*
• start_hour=*%24%28*
• start_hour=*wget*
• start_hour=*curl*
• start_hour=*tftp*
• start_hour=*busybox*
• start_hour=*chmod*
• start_hour=*sh*
• start_hour=*/bin/sh*
• start_hour=*uname*
• start_hour=*id*
• start_hour=*echo*
• start_hour=*nc*
• start_hour=*telnetd*
• GET /cgi-bin/nightled.cgi
• POST /cgi-bin/nightled.cgi
• /tmp/
• /var/tmp/
• /dev/shm/
• wget http://
• curl http://
• tftp -g
• chmod +x
• busybox wget
• busybox tftp

What your security team should do

• Immediately identify WAVLINK WN535K2 and WN535K3 routers in use, including unmanaged small-office, branch, lab, and remote-access locations.
• Treat internet-exposed devices as urgent due to critical severity, unauthenticated remote exploitation, weaponized exploit availability, and high EPSS probability.
• Disable WAN-side administration and restrict router management interfaces to trusted internal management networks or VPN-only access.
• Upgrade to patched firmware if available; if no supported fixed firmware exists, replace the device with a supported model.
• Hunt web, proxy, firewall, and network telemetry for requests to /cgi-bin/nightled.cgi containing start_hour values with shell metacharacters or command strings.
• Inspect affected routers for suspicious DNS settings, port forwards, startup changes, unknown binaries, and outbound connections to unusual IP addresses.
• Factory reset and reconfigure any exposed or suspicious device from trusted media, then rotate administrative credentials and any secrets that may have been exposed through router-managed traffic.
• Add detection logic for command-injection patterns targeting embedded CGI endpoints and monitor for post-exploitation tools such as wget, curl, tftp, busybox, sh, and chmod being invoked through web requests.