CVE-2024-39359

A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2024-39603

A stack-based buffer overflow vulnerability exists in the wireless.cgi setwifibasicmesh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2024-39757

A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2024-34544

CVE-2024-34544 affects the Wavlink AC3000 family (M33A8.V5030.210505). The vulnerability resides in wireless.cgi AddMac() where an unfiltered POST parameter (addMac) is copied to the heap and later used in an sprintf, then passed to system(), enabling arbitrary command execution after an authenti...

CVE-2024-34544

A command injection vulnerability exists in the wireless.cgi AddMac functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2024-36295

A command execution vulnerability exists in the qos.cgi qossta functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2024-39800

CVE-2024-39800 affects WAVLINK AC3000 (openvpn.cgi openvpn_server_setup). Talos details multiple external config control vulnerabilities in openvpn_server_setup, where an authenticated HTTP request can trigger injection of parameters (sel_open_server_val, open_port, open_server_name, sel_open_int...

CVE-2024-39602

An external config control vulnerability exists in the nas.cgi setnas functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2024-38666

An external config control vulnerability exists in the openvpn.cgi openvpnclientsetup functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2025-20055

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command...

CVE-2025-20055

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command...

PT-2025-2576

Name of the Vulnerable Software and Affected Versions Wavlink AC3000 version M33A8.V5030.210505 Description Multiple external configuration control vulnerabilities exist in the openvpn.cgi openvpn server setup functionality. A specially crafted HTTP request can lead to arbitrary command execution...

CVE-2024-39800: External Control of System or Configuration Setting

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpnserversetup functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these...

CVE-2024-39603: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the wireless.cgi setwifibasicmesh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

WAVLINK AC3000 Command Injection Vulnerability

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. A command injection vulnerability exists in the WAVLINK AC3000 M33A8.V5030.210505 version, which stems from the restarthourvalue parameter of the login.cgi setsysinit function failing to correctly filter the constructor command specia...

WAVLINK AC3000 security vulnerability

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from an external configuration control vulnerability that originates from the openvpn.cgi openvpnserversetup function's selopeninterface parameter failing to correctly filter constructed command special...

WAVLINK AC3000 Command Injection Vulnerability

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a command injection vulnerability that originates from the touchlistsync.cgi touchlistsync function failing to correctly filter constructed command special characters, commands, etc. An attacker could u...

PT-2025-2547

Name of the Vulnerable Software and Affected Versions: Wavlink AC3000 M33A8.V5030.210505 Description: A stack-based buffer overflow vulnerability exists in the set wifi basic mesh function of wireless.cgi. This issue can be triggered by a specially crafted HTTP request, potentially leading to...

PT-2025-4794 · Hewlett Packard · Hpe Aruba Networking Aos

The network management service is affected by an authenticated command injection issue in its command line interface, which could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Unfortunately, the specific versions of the network management...

CVE-2024-39602: External Control of System or Configuration Setting

An external config control vulnerability exists in the nas.cgi setnas functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...