CVE-2024-39754

CVE-2024-39754 affects WAVLINK AC3000 software, specifically the wctrls functionality in version M33A8.V5030.210505. The vulnerability involves an unauthenticated, WAN-accessible UDP service on port 36338 that processes crafted packets, enabling a remote attacker to gain root access and enable te...

CVE-2024-39754

A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability...

CVE-2024-39754

A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability...

CVE-2024-11497

An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access...

CVE-2024-11497 Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation

An authenticated attacker can use this vulnerability to perform a privilege escalation to gain root access...

WAVLINK AC3000 安全漏洞

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. The WAVLINK AC3000 suffers from a static login vulnerability that can be exploited by attackers to cause root access via specially crafted network packets...

Wavlink AC3000 wctrls static login vulnerability

Talos Vulnerability Report TALOS-2024-2034 Wavlink AC3000 wctrls static login vulnerability January 14, 2025 CVE Number CVE-2024-39754 SUMMARY A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead ...

PT-2025-1663 · Phoenix Contact · Charx Sec-3000 +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An authenticated attacker can use this issue to perform a privilege escalation to gain root access. This allows the attacker to elevate their privileges...

PT-2025-2552 · Wavlink · Wavlink Ac3000

Name of the Vulnerable Software and Affected Versions: Wavlink AC3000 version M33A8.V5030.210505 Description: A static login vulnerability exists in the wctrls functionality. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this...

The vulnerability of the VCM software, a security tool from Fortinet for Linux systems, relates to insecure privilege management. This vulnerability allows an attacker to elevate their privileges to the root level.

The vulnerability of the VCM software, a security tool from Fortinet’s FortiClient for Linux, is related to insecure management of privileges. Exploiting this vulnerability allows an attacker, operating remotely, to elevate their privileges to the root level...

The vulnerability of the SSH configuration function on the NSv Gen7 SonicOS Cloud cloud platform allows a hacker to elevate privileges to the root level and execute arbitrary code.

The vulnerability of the SSH configuration function on the NSv Gen7 SonicOS Cloud cloud platform is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to elevate privileges to the root level and execute arbitrary code...

CVE-2024-57811

In Eaton X303 3.5.16 - X303 3.5.17 Build 712, an attacker with network access to a XC-303 PLC can login as root over SSH. The root password is hardcoded in the firmware. NOTE: This vulnerability appears in versions that are no longer supported by Eaton...

CVE-2024-12847

NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been observed to be exploited ...

PT-2025-1029

Name of the Vulnerable Software and Affected Versions NETGEAR DGN1000 versions prior to 1.1.00.48 Description The NETGEAR DGN1000 router contains a flaw that allows bypassing the authentication process through the use of an alternative path or channel. Exploitation of this issue enables a remote,...

CVE-2024-54887

TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCfgRpm.htm. This vulnerability allows an authenticated attacker to execute arbitrary code on the remote device in the context of the root us...

CVE-2024-43656

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: Moderate – It might be difficult for an attacker to identify the fil...

CVE-2024-43654

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Iocharger firmware for AC models allows OS Command Injection as root This issue affects all Iocharger AC EV charger models on a firmware version before 25010801. Likelihood: Moderate – The binary do...

CVE-2024-43655

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701. Likelihood: Moderate – The attacker will first need to find the name of the...

CVE-2024-43649

Authenticated command injection in the filename of a .exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur...

CVE-2024-43652

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability allows OS Command Injection as root This issue affects Iocharger firmware for AC model chargers before version 24120701 Likelihood: Moderate – The binary does not seem to be used by the web interface, ...