CVE-2024-39784: Command Injection

Published Jan 14, 2025

Updated

Multiple command execution vulnerabilities exist in the nas.cgi adddir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the diskpart POST parameter.

Affected Software

3 affected components

Wavlink AC3000 M33A8

All of the following

Wavlink Wl-wn533a8 Firmware=m33a8.v5030.210505

Wavlink WL-WN533A8

Event History

Jan 14, 2025

CVE Published

via MITRE·02:20 PM

Data Sourced

via MITRE·02:20 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-39784?

CVE-2024-39784 has a high severity due to the potential for arbitrary command execution.

How do I fix CVE-2024-39784?

To address CVE-2024-39784, update the Wavlink AC3000 M33A8 firmware to the latest version.

What types of attacks can exploit CVE-2024-39784?

CVE-2024-39784 can be exploited through specially crafted HTTP requests that lead to command injection.

Who is affected by CVE-2024-39784?

CVE-2024-39784 affects users of the Wavlink AC3000 M33A8 router model.

Is user authentication required to exploit CVE-2024-39784?

Yes, an attacker must make an authenticated HTTP request to exploit CVE-2024-39784.