Command Injection Vulnerability in Wavlink AC3000 Router

CVE-2024-39765

What is CVE-2024-39765?

Multiple command injection vulnerabilities are present in the set_add_routing() function of the Wavlink AC3000 router. An attacker can execute arbitrary commands by sending specially crafted HTTP requests. This can be achieved with authenticated access, particularly exploiting the custom_interface POST parameter to gain control over the device and potentially compromise the network's integrity.

References