CVE-2024-38666
Published: 14 January 2025
Description
An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Security Summary
CVE-2024-38666 is an external config control vulnerability, classified under CWE-15, affecting the openvpn.cgi openvpn_client_setup() functionality in the Wavlink AC3000 router on firmware version M33A8.V5030.210505. The issue enables a specially crafted HTTP request to result in arbitrary command execution on the device.
Exploitation requires an authenticated attacker with high privileges (PR:H), who can send the malicious HTTP request over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The vulnerability has a CVSS v3.1 base score of 9.1 and a changed scope (S:C), allowing high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) through arbitrary command execution.
Mitigation guidance is available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051.
Details
- CWE(s)