CVE-2024-39363

Mode C: TALOS identifies CVE-2024-39363 as a persistent XSS in Wavlink AC3000 login.cgi set_lang_CountryCode(), affecting version M33A8.V5030.210505. An unauthenticated HTTP request can trigger a stored XSS, enabling information disclosure and potential session/cookie exposure, with risk to admin...

CVE-2024-39363

A cross-site scripting xss vulnerability exists in the login.cgi setlangCountryCode functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this...

CVE-2024-39759

CVE-2024-39759 affects the Wavlink AC3000 M33A8.V5030.210505 router, where multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() function. The root cause is improper handling of input in the restart_hour_value (and related) POST parameters, which can be invoked by un...

CVE-2024-39761

CVE-2024-39761 affects the Wavlink AC3000 (M33A8.V5030.210505). Talos and Red Hat/CNVD reports describe unauthenticated command-injection flaws in login.cgi set_sys_init(), specifically via restart_hour_value, restart_min_value, and restart_week_value parameters that can inject cron entries (SCH_...

CVE-2024-39761

Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A comman...

CVE-2024-39759

Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A comman...

CVE-2024-39761

Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A comman...

CVE-2024-39764

CVE-2024-39764 and related entries describe multiple OS command-injection flaws in Wavlink AC3000 M33A8.V5030.210505. The vulnerability surface centers on the internet.cgi set_add_routing() function, with the dest POST parameter (and other inputs such as netmask, gateway, interface, custom_interf...

CVE-2024-36290

A buffer overflow vulnerability exists in the login.cgi Gotochidx functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

CVE-2024-39764

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A...

CVE-2024-39764

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A...

CVE-2024-36290

CVE-2024-36290 affects the Wavlink AC3000 model M33A8.V5030.210505. Talos details a buffer overflow in the login.cgi Goto_chidx() function, triggered by unauthenticated HTTP requests, leading to a stack-based overflow and potential code execution on the device. The vulnerability is rated critical...

CVE-2024-39763

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A...

CVE-2024-39763

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A...

CVE-2024-39765

CVE-2024-39765 affects Wavlink AC3000 (M33A8.V5030.210505). Talos-reported vulnerabilities in internet.cgi set_add_routing() allow OS command injection via the custom_interface POST parameter, potentially enabling arbitrary command execution after authentication. The exploit path involves constru...

CVE-2024-39765

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A...

CVE-2024-39765

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A...

CVE-2024-39763

CVE-2024-39763 affects Wavlink AC3000 M33A8.V5030.210505. Talos details multiple OS command-injection vulnerabilities in the internet.cgi set_add_routing() function, exploitable via authenticated HTTP requests. The gateway, netmask, dest, interface, custom_interface, and related POST parameters c...

CVE-2024-39288

CVE-2024-39288 has concrete details in the TALOS advisory: a buffer overflow in the Wavlink AC3000 router’s internet.cgi set_add_routing() function (M33A8.V5030.210505). An authenticated HTTP request can craft input that overflows a stack buffer, allowing arbitrary code execution or a crash. Affe...

CVE-2024-39288

A buffer overflow vulnerability exists in the internet.cgi setaddrouting functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability...