by Kastro
Paper/Archive/CVE-2024-34166

CVE-2024-34166

Wavlink Wavlink AC3000 — An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505.

EPSS 16%CVSS 10.0
critical.is priorityof 100
49
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 96.9.969 × 2019.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of HTTP requests can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
Wavlink AC3000M33A8.V5030.210505–CNA

Scores by source

talos (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2024-2000reftalosintelligence.com/vulnerability_reports/TALOS-2024-2000