CVE-2024-21797
Published: 14 January 2025
Description
A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Security Summary
CVE-2024-21797 is a command execution vulnerability in the adm.cgi set_TR069() functionality of the Wavlink AC3000 running firmware version M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution on the affected device. The vulnerability is associated with CWE-74 and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability.
An authenticated attacker with high privileges (PR:H) can exploit this vulnerability remotely by sending a malicious HTTP request to the adm.cgi endpoint. No user interaction is required, and the attack has a scope change (S:C), enabling the attacker to execute arbitrary commands on the device, potentially leading to full compromise including data exfiltration, modification, or disruption of services.
Mitigation details are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2028. The vulnerability was published on 2025-01-14.
Details
- CWE(s)