CVE-2024-37184CWE-120

A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505

Critical · published January 14, 2025

CVSS v3.1
9.1
EPSS
1%
Percentile
71.3
In the wild
Unconfirmed
What it is

🔥 A single malicious HTTP request can send your Wavlink AC3000 M33A8 spiraling into chaos! Think of this vulnerability like a restaurant where a customer can yell their order in a way that overflows the kitchen with too many dishes at once, causing the whole operation to break down. One rogue request can jam up the system, leaving it vulnerable to all sorts of mischief! An attacker could exploit this vulnerability to execute arbitrary code, leading to unauthorized access or complete system takeover. This could result in the loss of sensitive data and disrupt network operations. The consequences are absolutely devastating!

Put simply

Think of this vulnerability like a restaurant where a customer can yell their order in a way that overflows the kitchen with too many dishes at once, causing the whole operation to break down. One rogue request can jam up the system, leaving it vulnerable to all sorts of mischief! This buffer overflow vulnerability in the adm.cgi rep_as_bridge() function allows an authenticated attacker to send a specially crafted HTTP request that can overflow the stack, potentially allowing remote code execution.

What to do

An attacker could exploit this vulnerability to execute arbitrary code, leading to unauthorized access or complete system takeover. This could result in the loss of sensitive data and disrupt network operations. The consequences are absolutely devastating! Update your Wavlink AC3000 M33A8 to the latest firmware version to patch this critical vulnerability. Ensure that only trusted users have access to authenticated HTTP requests and monitor logs for any suspicious activities. It's time for a security audit! You've got this! With these steps, you'll bolster your defenses and keep your network safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01350 · 71.3th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-01-14T14:21Z
EPSS history
Timeline
  • 14 JAN 14:21Z
    A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505
    cvelistv5