CVE-2024-39360: Command Injection

Published Jan 14, 2025

Updated

An os command injection vulnerability exists in the nas.cgi removedir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Affected Software

3 affected components

Wavlink AC3000 M33A8

All of the following

Wavlink Wl-wn533a8 Firmware=m33a8.v5030.210505

Wavlink WL-WN533A8

Event History

Jan 14, 2025

CVE Published

via MITRE·02:20 PM

Data Sourced

via MITRE·02:20 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-39360?

CVE-2024-39360 is considered a high severity vulnerability due to its potential for arbitrary code execution.

How do I fix CVE-2024-39360?

To remediate CVE-2024-39360, you should apply any available firmware updates from Wavlink that address this vulnerability.

What causes CVE-2024-39360?

CVE-2024-39360 is caused by an OS command injection vulnerability in the remove_dir() functionality of nas.cgi.

Who is affected by CVE-2024-39360?

Vulnerable devices include the Wavlink AC3000 M33A8 running the specific firmware version V5030.210505.

What can attackers achieve by exploiting CVE-2024-39360?

Exploiting CVE-2024-39360 can allow attackers to execute arbitrary code through specially crafted HTTP requests.