Paper/Archive/CVE-2024-34544

CVE-2024-34544

Wavlink Wavlink AC3000 — A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505.

EPSS 9%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 95.2.952 × 2019.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource

Wavlink AC3000M33A8.V5030.210505–CNA

Scores by source

talos (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2024-2044 reftalosintelligence.com/vulnerability_reports/TALOS-2024-2044