by Kastro
Paper/Archive/CVE-2024-39359

CVE-2024-39359

Wavlink Wavlink AC3000 — A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505.

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 84.5.845 × 2016.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
Wavlink AC3000M33A8.V5030.210505–CNA

Scores by source

talos (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2024-2040reftalosintelligence.com/vulnerability_reports/TALOS-2024-2040