Multiple external configuration vulnerabilities in Wavlink AC3000 M33A8
CVE-2024-39800
9.1CRITICAL
What is CVE-2024-39800?
The Wavlink AC3000 M33A8 device contains multiple vulnerabilities in its openvpn.cgi openvpn_server_setup() functionality. Attackers can exploit these flaws by sending specially crafted HTTP requests which may lead to arbitrary command execution. Additionally, a configuration injection vulnerability has been identified that affects the open_port
POST parameter, allowing unauthorized configuration manipulation. Addressing these vulnerabilities is crucial for ensuring the integrity and security of network configurations.
Affected Version(s)
Wavlink AC3000 M33A8.V5030.210505