CVE-2024-39299

A stack-based buffer overflow vulnerability, designated CVE-2024-39299 and associated with CWE-120, affects the qos.cgi qos_sta_settings() functionality in the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The issue arises when processing a specially crafted HTTP request, leading to a buffer overflow condition that can overwrite stack memory. This vulnerability received a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and potential for high-impact confidentiality, integrity, and availability effects across a changed scope.

An authenticated attacker with high privileges, such as administrative access to the device, can exploit this vulnerability by sending a malicious HTTP request to the qos.cgi endpoint. Successful exploitation enables arbitrary code execution, potentially granting full control over the router, including the ability to execute commands, modify configurations, or pivot to other network resources, given the scope change and high impact ratings.

The primary advisory from Talos Intelligence (TALOS-2024-2048) documents this vulnerability; practitioners should consult it for detailed technical analysis, proof-of-concept details, and recommended mitigations, as no specific patches are detailed in the available CVE information.