by Kastro
Paper/Archive/CVE-2024-39367

CVE-2024-39367

Wavlink Wavlink AC3000 — An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505.

EPSS 8%CVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 95.0.950 × 2019.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
Wavlink AC3000M33A8.V5030.210505–CNA

Scores by source

talos (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2024-2023reftalosintelligence.com/vulnerability_reports/TALOS-2024-2023