CVE-2024-39602
Published: 14 January 2025
Description
An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Security Summary
CVE-2024-39602 is an external config control vulnerability, classified under CWE-15, in the nas.cgi set_nas() functionality of the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The issue enables arbitrary command execution via a specially crafted HTTP request. Published on January 14, 2025, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity.
The vulnerability can be exploited by an authenticated attacker possessing high privileges (PR:H) who sends a malicious HTTP request over the network (AV:N) with low attack complexity (AC:L). Successful exploitation grants arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability, with a scope change (S:C) that amplifies the effects beyond the vulnerable component.
For mitigation guidance, including any available patches or workarounds, security practitioners should refer to the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2052.
Details
- CWE(s)