Firmware Update Vulnerability in Wavlink AC3000 M33A8
CVE-2024-39273

9CRITICAL

Key Information:

Vendor

Wavlink

Status
Wavlink Ac3000
Vendor
CVE Published:
14 January 2025

What is CVE-2024-39273?

A vulnerability in the fw_check.sh functionality of the Wavlink AC3000 M33A8 device allows for arbitrary firmware updates via specially crafted HTTP requests. This flaw can be exploited through a man-in-the-middle attack, giving attackers the potential to compromise the device's firmware, which could lead to unauthorized access and control over the device. Ensuring proper security measures are in place is essential to mitigate this risk.

Affected Version(s)

Wavlink AC3000 M33A8.V5030.210505

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

Credit

Discovered by Lilith >_> of Cisco Talos.
.