CVE-2024-39757
Published: 14 January 2025
Description
A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Security Summary
A stack-based buffer overflow vulnerability, tracked as CVE-2024-39757 and associated with CWE-121, affects the wireless.cgi AddMac() functionality in the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The flaw allows a specially crafted HTTP request to overflow the stack buffer, potentially leading to arbitrary command execution.
An attacker with high privileges (PR:H), such as an authenticated administrative user, can exploit this vulnerability over the network (AV:N) with low complexity (AC:L). Successful exploitation grants scope-changed (S:C) high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H), enabling full arbitrary command execution on the device.
Mitigation details are provided in the Cisco Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2043, which includes technical analysis and recommendations for addressing the vulnerability.
Details
- CWE(s)