CVE-2024-39754
Published: 14 January 2025
Description
A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability.
Security Summary
CVE-2024-39754 is a static login vulnerability in the wctrls functionality of the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The issue allows a specially crafted set of network packets to lead to root access on the affected device. It is classified under CWE-912 and was published on 2025-01-14 with a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critical.
An unauthenticated attacker with network access can exploit this vulnerability by sending specially crafted packets to the device. Successful exploitation grants root-level privileges, enabling high-impact compromise of confidentiality, integrity, and availability without requiring privileges, user interaction, or high complexity.
Further technical details are provided in the Talos Intelligence vulnerability report at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2034.
Details
- CWE(s)