CVE-2024-39288CWE-120

A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505

Critical Β· published January 14, 2025

CVSS v3.1
9.1
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

🚨 A single crafted HTTP request is all it takes to exploit a critical buffer overflow in Wavlink AC3000 β€” it’s like sending a pizza order with a hidden bomb attached! πŸ•πŸ’£ Think of it as a restaurant where a customer sneaks in an oversized order that bursts the kitchen's capacity β€” one tiny miscalculation can send everything into chaos. Similarly, this vulnerability allows an attacker to overflow the stack and potentially control the device! An attacker could unleash chaos by exploiting this vulnerability, leading to system crashes or remote code execution, which is absolutely devastating. Imagine hackers taking over your router and wreaking havoc on your network β€” personal data at risk, connections severed, and privacy violated!

Put simply

Think of it as a restaurant where a customer sneaks in an oversized order that bursts the kitchen's capacity β€” one tiny miscalculation can send everything into chaos. Similarly, this vulnerability allows an attacker to overflow the stack and potentially control the device! This buffer overflow vulnerability resides in the set_add_routing() function of the Wavlink AC3000, which fails to properly handle specially crafted HTTP requests β€” allowing an authenticated user to overwrite the stack memory.

What to do

An attacker could unleash chaos by exploiting this vulnerability, leading to system crashes or remote code execution, which is absolutely devastating. Imagine hackers taking over your router and wreaking havoc on your network β€” personal data at risk, connections severed, and privacy violated! To protect your system, update to the latest firmware version as soon as possible. Ensure all devices are configured to use strong authentication methods, and consider monitoring logs for suspicious activities related to HTTP requests β€” vigilance is key! You can tackle this vulnerability! Update your firmware and secure your network to keep those hackers at bay. You've got this! πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
9.1 Β· CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.13848 Β· 96.5th percentile
Weakness
CWE-120 Β· Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-01-14T14:21Z
EPSS history
Timeline
  • 14 JAN 14:21Z
    A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505
    cvelistv5