CVE-2024-39756CWE-120

A buffer overflow vulnerability exists in the adm.cgi rep_as_router() functionality of Wavlink AC3000 M33A8.V5030.210505

Critical · published January 14, 2025

CVSS v3.1
9.1
EPSS
2%
Percentile
79.8
In the wild
Unconfirmed
What it is

🚨 A crafty HTTP request could trigger a devastating stack-based buffer overflow in Wavlink AC3000, leaving your network wide open to attack! 🔥 Think of it like a restaurant where a sneaky guest crafts a perfect fake order that overwhelms the kitchen, causing chaos as the chefs scramble to keep up and shut down the whole operation. In this case, the server gets overloaded, and the attacker could gain control! With this vulnerability, an attacker can exploit it to execute arbitrary code, gaining full control of the router and potentially compromising your entire network. This could lead to data breaches, unauthorized access to sensitive information, and a complete disruption of your communications. It's absolutely critical to address this before it becomes a full-blown disaster!

Put simply

Think of it like a restaurant where a sneaky guest crafts a perfect fake order that overwhelms the kitchen, causing chaos as the chefs scramble to keep up and shut down the whole operation. In this case, the server gets overloaded, and the attacker could gain control! This buffer overflow vulnerability exists in the adm.cgi rep_as_router() functionality, where a specially crafted HTTP request can overflow the stack. An authenticated user can trigger this overflow, potentially allowing an attacker to run arbitrary code on the device.

What to do

With this vulnerability, an attacker can exploit it to execute arbitrary code, gaining full control of the router and potentially compromising your entire network. This could lead to data breaches, unauthorized access to sensitive information, and a complete disruption of your communications. It's absolutely critical to address this before it becomes a full-blown disaster! Immediate action is required: patch your Wavlink AC3000 M33A8 to the latest firmware version to close this vulnerability. Ensure that all authenticated users are aware of this issue and educate them on secure practices. Regularly audit your network for any suspicious activity as a precaution! You've got this! With the right steps, you'll keep your network safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01927 · 79.8th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-01-14T14:21Z
EPSS history
Timeline
  • 14 JAN 14:21Z
    A buffer overflow vulnerability exists in the adm.cgi rep_as_router() functionality of Wavlink AC3000 M33A8.V5030.210505
    cvelistv5