CVE-2024-39764 - Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505

Back Back to CVE browser

CRITICAL

Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505

Published Jan 14, 2025

9.1

CRITICAL

CVSS 3.1

EPSS 4.16%

Description

Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the `dest` POST parameter.

Affected products

Vendor Wavlink Product Wavlink AC3000 Default
n/a
- Version
  M33A8.V5030.210505
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wavlink

Wavlink AC3000

n/a

Version	Status	Constraints
M33A8.V5030.210505	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (2)

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2020
ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2020

Link	Providers	Tags
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2020		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2020

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner talos

Published Jan 14, 2025

Updated Nov 3, 2025

Reserved Jun 28, 2024

Link CVE-2024-39764

CISA Vulnrichment

Updated Jan 14, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2024-39764

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-39764