CVE-2024-39785: Command Injection

Published Jan 14, 2025

Updated

Multiple command execution vulnerabilities exist in the nas.cgi adddir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the adddirname POST parameter.

Affected Software

3 affected components

Wavlink AC3000=M33A8.V5030.210505

All of the following

Wavlink Wl-wn533a8 Firmware=m33a8.v5030.210505

Wavlink WL-WN533A8

Event History

Jan 14, 2025

CVE Published

via MITRE·02:20 PM

Data Sourced

via MITRE·02:20 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-39785?

CVE-2024-39785 is classified as a critical vulnerability due to its potential for arbitrary command execution.

How do I fix CVE-2024-39785?

To fix CVE-2024-39785, update your Wavlink AC3000 M33A8.V5030.210505 firmware to the latest version provided by Wavlink.

What causes CVE-2024-39785?

CVE-2024-39785 is caused by multiple command execution vulnerabilities in the add_dir() function of nas.cgi.

Who is affected by CVE-2024-39785?

CVE-2024-39785 affects users of the Wavlink AC3000 M33A8.V5030.210505 device.

Can CVE-2024-39785 be exploited remotely?

Yes, CVE-2024-39785 can be exploited remotely through a specially crafted HTTP request.