CVE-2024-39769 - Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505

Back Back to CVE browser

CRITICAL

Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505

Published Jan 14, 2025

9.1

CRITICAL

CVSS 3.1

EPSS 0.88%

Description

Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability exists in the `cli_mac` POST parameter.

Affected products

Vendor Wavlink Product Wavlink AC3000 Default
n/a
- Version
  M33A8.V5030.210505
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wavlink

Wavlink AC3000

n/a

Version	Status	Constraints
M33A8.V5030.210505	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38395
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2022
ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2022

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-38395		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2022		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2022