CVE-2024-39799 - Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505

Back Back to CVE browser

CRITICAL

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505

Published Jan 14, 2025

9.1

CRITICAL

CVSS 3.1

EPSS 1.30%

Description

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the `sel_open_interface` POST parameter.

Affected products

Vendor Wavlink Product Wavlink AC3000 Default
n/a
- Version
  M33A8.V5030.210505
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wavlink

Wavlink AC3000

n/a

Version	Status	Constraints
M33A8.V5030.210505	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-15

References (2)

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2050
ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2050

Link	Providers	Tags
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2050		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2050

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner talos

Published Jan 14, 2025

Updated Nov 3, 2025

Reserved Jun 28, 2024

Link CVE-2024-39799

CISA Vulnrichment

Updated Jan 15, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2024-39799

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-39799