CVE-2024-39603

A stack-based buffer overflow vulnerability, tracked as CVE-2024-39603 and associated with CWE-121, affects the wireless.cgi set_wifi_basic_mesh() functionality in the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The flaw arises when processing a specially crafted HTTP request, enabling arbitrary command execution. This issue received a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), highlighting its critical severity due to network accessibility, low attack complexity, and high confidentiality, integrity, and availability impacts with a changed scope.

Exploitation requires an authenticated attacker with high privileges (PR:H) to send a malicious HTTP request to the vulnerable endpoint. Upon successful triggering of the buffer overflow, the attacker can achieve arbitrary command execution on the device, potentially leading to full compromise of the router, including data exfiltration, further network pivoting, or persistent access.

Details on mitigation, patches, or workarounds are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2042. Security practitioners should consult this reference for vendor-specific remediation guidance.