CVE-2024-39787: Path Traversal

Published Jan 14, 2025

Updated

Multiple directory traversal vulnerabilities exist in the nas.cgi adddir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A directory traversal vulnerability exists within the diskpart POST parameter.

Affected Software

3 affected components

Wavlink AC3000 M33A8

All of the following

Wavlink Wl-wn533a8 Firmware=m33a8.v5030.210505

Wavlink WL-WN533A8

Event History

Jan 14, 2025

CVE Published

via MITRE·02:20 PM

Data Sourced

via MITRE·02:20 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2024-39787?

CVE-2024-39787 refers to multiple directory traversal vulnerabilities in the nas.cgi add_dir() function of Wavlink AC3000 M33A8, which can lead to permission bypass.

What are the potential impacts of CVE-2024-39787?

The potential impact of CVE-2024-39787 includes unauthorized access to restricted files and directories on the affected device.

How do I fix CVE-2024-39787?

To fix CVE-2024-39787, update the Wavlink AC3000 M33A8 firmware to the latest version provided by the vendor.

Who is affected by CVE-2024-39787?

Users of the Wavlink AC3000 M33A8 router with the specified firmware version are affected by CVE-2024-39787.

How can an attacker exploit CVE-2024-39787?

An attacker can exploit CVE-2024-39787 by sending a specially crafted authenticated HTTP request to trigger the directory traversal vulnerabilities.