Command Injection Vulnerability in Wavlink AC3000 Router

CVE-2024-39783

What is CVE-2024-39783?

The Wavlink AC3000 M33A8 router contains multiple OS command injection vulnerabilities within the adm.cgi sch_reboot() functionality. These vulnerabilities allow attackers to execute arbitrary code by crafting malicious HTTP requests. Specifically, exploiting the 'restart_week' POST parameter can lead to unauthorized actions on the device, enabling an attacker with required authentication to compromise the router's integrity and potentially access sensitive information.

References