CVE-2024-38666

CRITICAL

Wavlink AC3000 M33A8.V5030.210505 - Command Injection

Title source: llm
STIX 2.1

Description

An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

References (2)

Scores

CVSS v3 9.1
EPSS 0.0585
EPSS Percentile 90.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-15
Status published
Products (1)
wavlink/wl-wn533a8_firmware m33a8.v5030.210505
Published Jan 14, 2025
Tracked Since Feb 18, 2026