Command Injection Vulnerabilities in Wavlink AC3000 Router

CVE-2024-39784

What is CVE-2024-39784?

Multiple command injection vulnerabilities have been identified in the nas.cgi add_dir() function of the Wavlink AC3000 M33A8.V5030.210505 router. By sending a specially crafted HTTP request, an authenticated attacker can exploit these vulnerabilities to execute arbitrary commands on the device. Additionally, a specific command injection vulnerability has been discovered in the disk_part POST parameter, which further exposes the system to potential attacks. It is crucial for users to assess their systems and apply necessary security measures to mitigate these risks.

References