CVE-2024-37186: Command Injection
An os command injection vulnerability exists in the adm.cgi setledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37186?
CVE-2024-37186 has a high severity due to its potential for arbitrary code execution through OS command injection.
How do I fix CVE-2024-37186?
To fix CVE-2024-37186, you should apply the latest firmware updates provided by Wavlink that address this vulnerability.
Who is affected by CVE-2024-37186?
CVE-2024-37186 affects Wavlink AC3000 M33A8 devices running specific firmware versions.
What type of attack does CVE-2024-37186 enable?
CVE-2024-37186 enables attackers to execute arbitrary commands on the affected device through specially crafted HTTP requests.
Is authentication required to exploit CVE-2024-37186?
Yes, an attacker must be authenticated to exploit the CVE-2024-37186 vulnerability.