CVE-2024-39367 - An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505

Back Back to CVE browser

CRITICAL

An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505

Published Jan 14, 2025

9.1

CRITICAL

CVSS 3.1

EPSS 8.25%

Description

An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected products

Vendor Wavlink Product Wavlink AC3000 Default
n/a
- Version
  M33A8.V5030.210505
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wavlink

Wavlink AC3000

n/a

Version	Status	Constraints
M33A8.V5030.210505	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38390
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2023
ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2023
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38390		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2023		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2023		ExploitThird Party Advisory