CVE-2024-39280: External Control of System or Configuration Setting

An external config control vulnerability exists in the nas.cgi setsmbcfg functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

PT-2025-2538 · Wavlink · Wavlink Ac3000

Name of the Vulnerable Software and Affected Versions: Wavlink AC3000 version M33A8.V5030.210505 Description: A stack-based buffer overflow issue exists in the SetName functionality of wireless.cgi. This can be triggered by a specially crafted HTTP request, potentially leading to arbitrary comman...

PT-2025-2533 · Wavlink · Wavlink Ac3000

Name of the Vulnerable Software and Affected Versions: Wavlink AC3000 version M33A8.V5030.210505 Description: A vulnerability exists in the set smb cfg function of nas.cgi, allowing for external configuration control. This can be exploited through a specially crafted HTTP request, potentially...

CVE-2024-39799: External Control of System or Configuration Setting

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpnserversetup functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...

Wavlink AC3000 openvpn.cgi openvpn_server_setup() Configuration Control Vulnerabilities

Talos Vulnerability Report TALOS-2024-2050 Wavlink AC3000 openvpn.cgi openvpnserversetup Configuration Control Vulnerabilities January 14, 2025 CVE Number CVE-2024-39798,CVE-2024-39800,CVE-2024-39799 SUMMARY Multiple external config control vulnerabilities exists in the openvpn.cgi...

CVE-2024-39357: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Wavlink AC3000 nas.cgi set_smb_cfg() Configuration Control Vulnerability

Talos Vulnerability Report TALOS-2024-2055 Wavlink AC3000 nas.cgi setsmbcfg Configuration Control Vulnerability January 14, 2025 CVE Number CVE-2024-39280 SUMMARY An external config control vulnerability exists in the nas.cgi setsmbcfg functionality of Wavlink AC3000 M33A8.V5030.210505. A special...

Stealthone D220 and Stealthone D340 have operating system command injection vulnerabilities

The STEALTHONE D220 and STEALTHONE D340 are both network storage servers from STEALTHONE. An operating system command injection vulnerability exists in the STEALTHONE D220 and STEALTHONE D340, which can be exploited to execute arbitrary operating system commands by an attacker with access to the...

CVE-2024-39763: Improper Neutralization of Special Elements used in a Command

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A...

Wavlink AC3000 qos.cgi qos_sta() command injection vulnerability

Talos Vulnerability Report TALOS-2024-2047 Wavlink AC3000 qos.cgi qossta command injection vulnerability January 14, 2025 CVE Number CVE-2024-36295 SUMMARY A command execution vulnerability exists in the qos.cgi qossta functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP...

Lenovo XClarity Controller Command Execution

The vulnerability of the Lenovo XClarity Controller XCC for Lenovo ThinkSystem systems is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially created files...

Lenovo XClarity Controller Command Execution

The vulnerability of the Lenovo XClarity Controller XCC for Lenovo ThinkSystem systems is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially created files...

Lenovo XClarity Controller Command Injection

The vulnerability of the web interface or command interface of the Lenovo XClarity Controller XCC for Lenovo ThinkSystem servers is related to the failure to take measures to neutralize certain elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a...

SUSE CVE-2024-28892

An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

Linksys E7350 security vulnerabilities

The Linksys E7350 is a wireless router device from Leadsys. A security vulnerability exists in the handling of the ifname parameter in the Linksys E7350 apclidoenrpinwps function, which can be exploited by a remote attacker to submit a special request that can be used in the application context t...

CVE-2024-43659: Plaintext Storage of a Password

After gaining access to the firmware of a charging station, a file at can be accessed to obtain default credentials that are the same across all Iocharger AC model EV chargers. This issue affects Iocharger firmware for AC models before firmware version 25010801. The issue is addressed by requirin...

CVE-2024-27980: Improper Neutralization of Special Elements used in a Command

Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled...

iocharger security vulnerability

iocharger is an electric vehicle charging and smart energy management solution from the Chinese company Galaxy Zhangtan iocharger. iocharger suffers from a command injection vulnerability that stems from the application's failure to properly filter constructed command special characters, commands...

Arbitrary Command Injection

Overview composio-core is a Core package to act as a bridge between composio platform and other services. Affected versions of this package are vulnerable to Arbitrary Command Injection via the handletoolcalls function due to improper user input sanitization. PoC py from composioopenai import...

CVE-2024-51442

A command injection vulnerability exists in Minidlna (also known as Readyshare) versions v1.3.3 and before . The flaw resides in the rescan functionality within the check_db function in minidlna.c. It occurs because the software fails to properly neutralize special elements when constructing a co...