by Kastro
Paper/Archive/CVE-2024-39608

CVE-2024-39608

Wavlink Wavlink AC3000 — A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505.

EPSS 1%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 73.6.736 × 2014.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can send an unauthenticated message to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
Wavlink AC3000M33A8.V5030.210505–CNA

Scores by source

talos (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reftalosintelligence.com/vulnerability_reports/TALOS-2024-2036reftalosintelligence.com/vulnerability_reports/TALOS-2024-2036