Read the docs
TI-2024-14944 Aliases CVE-2024-22366GHSA-ghrw-6hf4-xx3c

OS command injection in Yamaha Corporation WLX222

Priority LOW 32CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.

Summary

Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's management page, this function can be enabled by performing specific operations. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered. Affected products and versions are as follows: WLX222 firmware Rev.24.00.03 and earlier, WLX413 firmware Rev.22.00.05 and earlier, WLX212 firmware Rev.21.00.12 and earlier, WLX313 firmware Rev.18.00.12 and earlier, and WLX202 firmware Rev.16.00.18 and earlier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Yamaha CorporationWLX222firmware Rev.24.00.03 and earlier—No fix listedCNA
Yamaha CorporationWLX413firmware Rev.22.00.05 and earlier—No fix listedCNA
Yamaha CorporationWLX212firmware Rev.21.00.12 and earlier—No fix listedCNA
Yamaha CorporationWLX313firmware Rev.18.00.12 and earlier—No fix listedCNA
Yamaha CorporationWLX202firmware Rev.16.00.18 and earlier—No fix listedCNA
  • WLX222 VendorYamaha Corporation Affected firmware Rev.24.00.03 and earlier Fixed in — No fix listed CNA
  • WLX413 VendorYamaha Corporation Affected firmware Rev.22.00.05 and earlier Fixed in — No fix listed CNA
  • WLX212 VendorYamaha Corporation Affected firmware Rev.21.00.12 and earlier Fixed in — No fix listed CNA
  • WLX313 VendorYamaha Corporation Affected firmware Rev.18.00.12 and earlier Fixed in — No fix listed CNA
  • WLX202 VendorYamaha Corporation Affected firmware Rev.16.00.18 and earlier Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:yamaha:wlx222_firmware:*:*:*:*:*:*:*:*before 24.00.04VulnerableYamaha Corporation
cpe:2.3:h:yamaha:wlx222:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
cpe:2.3:o:yamaha:wlx413_firmware:*:*:*:*:*:*:*:*before 22.00.06VulnerableYamaha Corporation
cpe:2.3:h:yamaha:wlx413:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
cpe:2.3:o:yamaha:wlx212_firmware:*:*:*:*:*:*:*:*before 21.00.13VulnerableYamaha Corporation
cpe:2.3:h:yamaha:wlx212:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
cpe:2.3:o:yamaha:wlx313_firmware:*:*:*:*:*:*:*:*before 18.00.13VulnerableYamaha Corporation
cpe:2.3:h:yamaha:wlx313:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
cpe:2.3:o:yamaha:wlx202_firmware:*:*:*:*:*:*:*:*before 16.00.19VulnerableYamaha Corporation
cpe:2.3:h:yamaha:wlx202:-:*:*:*:*:*:*:*not specified by NVDRunning onYamaha Corporation
  • cpe:2.3:o:yamaha:wlx222_firmware:*:*:*:*:*:*:*:* Versions before 24.00.04 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:wlx222:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation
  • cpe:2.3:o:yamaha:wlx413_firmware:*:*:*:*:*:*:*:* Versions before 22.00.06 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:wlx413:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation
  • cpe:2.3:o:yamaha:wlx212_firmware:*:*:*:*:*:*:*:* Versions before 21.00.13 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:wlx212:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation
  • cpe:2.3:o:yamaha:wlx313_firmware:*:*:*:*:*:*:*:* Versions before 18.00.13 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:wlx313:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation
  • cpe:2.3:o:yamaha:wlx202_firmware:*:*:*:*:*:*:*:* Versions before 16.00.19 Vulnerable ·Yamaha Corporation
  • cpe:2.3:h:yamaha:wlx202:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yamaha Corporation

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22366
  2. 2026-10-03 Alias added: GHSA-ghrw-6hf4-xx3c

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences