Buffer Overflow Vulnerability in Wavlink AC3000 M33A8 Product
CVE-2024-39294

9.1CRITICAL

Key Information:

Vendor

Wavlink

Status
Wavlink Ac3000
Vendor
CVE Published:
14 January 2025

What is CVE-2024-39294?

A buffer overflow vulnerability has been identified in the adm.cgi set_wzdgw4G() functionality of Wavlink AC3000 M33A8. Attackers can exploit this vulnerability by sending specially crafted HTTP requests, which may lead to a stack-based buffer overflow. Consequently, this can result in unauthorized actions or system compromise. It is crucial for users to apply security updates and follow best practices for securing web interfaces to mitigate potential threats.

Affected Version(s)

Wavlink AC3000 M33A8.V5030.210505

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

Credit

Discovered by Lilith >_> of Cisco Talos.
.