CVE-2024-39288
Published: 14 January 2025
Description
A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Security Summary
CVE-2024-39288 is a stack-based buffer overflow vulnerability in the set_add_routing() functionality of the internet.cgi component within Wavlink AC3000 firmware version M33A8.V5030.210505. The flaw is triggered by a specially crafted HTTP request that overflows the buffer, as classified under CWE-120.
Exploitation requires an authenticated attacker with high privileges (PR:H per CVSS v3.1), who can remotely send the malicious HTTP request over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) with a changed scope (S:C), yielding a CVSS score of 9.1.
Mitigation guidance is detailed in the Talos Intelligence advisories at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2021 and https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2021.
Details
- CWE(s)