by Kastro
Paper/Archive/CVE-2024-39602

CVE-2024-39602

Wavlink Wavlink AC3000 — An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505.

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 83.9.839 × 2016.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
Wavlink AC3000M33A8.V5030.210505–CNA

Scores by source

talos (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2024-2052reftalosintelligence.com/vulnerability_reports/TALOS-2024-2052