CVE-2024-34166 - An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505

Back Back to CVE browser

CRITICAL

An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505

Published Jan 14, 2025

10.0

CRITICAL

CVSS 3.1

EPSS 15.79%

Description

An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of HTTP requests can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability.

Affected products

Vendor Wavlink Product Wavlink AC3000 Default
n/a
- Version
  M33A8.V5030.210505
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wavlink

Wavlink AC3000

n/a

Version	Status	Constraints
M33A8.V5030.210505	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (2)

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2000
ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2000
ExploitThird Party Advisory

Link	Providers	Tags
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2000		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2000		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner talos

Published Jan 14, 2025

Updated Jan 14, 2025

Reserved May 10, 2024

Link CVE-2024-34166

CISA Vulnrichment

Updated Jan 14, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-34166

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-34166