CVE-2024-39802
Published: 14 January 2025
Description
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the `qos_dat` POST parameter.
Security Summary
Multiple buffer overflow vulnerabilities, including stack-based ones, affect the qos.cgi qos_settings() functionality in the Wavlink AC3000 router firmware version M33A8.V5030.210505. These flaws arise from insufficient input validation, particularly in the qos_dat POST parameter, allowing a specially crafted HTTP request to overflow buffers and potentially corrupt the stack.
An attacker with high privileges (PR:H), such as an authenticated administrative user, can exploit these vulnerabilities remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Exploitation triggers a scope change (S:C), enabling high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), as reflected in the CVSS v3.1 base score of 9.1. The issues stem from CWE-120 (buffer copy without checking size of input).
Mitigation guidance and further technical details are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2049.
Details
- CWE(s)