CVE-2022-41489

HIGH

WAYOS LQ-09 22.03.17V - Cross-Site Request Forgery via Usb_upload.htm

Title source: llm

Description

WAYOS LQ_09 22.03.17V was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usb_upload.htm.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://github.com/splashsc/IOT_Vulnerability_Discovery/blob/main/wayos/wayos_LQ-09%2022_enterprise-class/3_csrf.md

Scores

CVSS v3 8.1

EPSS 0.0040

EPSS Percentile 31.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-352

Status published

Products (6)

wayos/lq-04_firmware 22.03.17

wayos/lq-05_firmware 22.03.17

wayos/lq-06_firmware 22.03.17

wayos/lq-07_firmware 22.03.17

wayos/lq-08_firmware 22.03.17

wayos/lq-09_firmware 22.03.17

Published Oct 13, 2022

Tracked Since Feb 18, 2026