CVE-2024-39798: Critical severity wavlink jetstream ac3000 vulnerability

Published Jan 14, 2025

Updated

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpnserversetup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the selopenprotocol POST parameter.

Affected Software

3 affected components

Wavlink AC3000 M33A8

All of the following

Wavlink Wl-wn533a8 Firmware=m33a8.v5030.210505

Wavlink WL-WN533A8

Event History

Jan 14, 2025

CVE Published

via MITRE·02:21 PM

Data Sourced

via MITRE·02:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-39798?

CVE-2024-39798 has been classified as a high severity vulnerability due to its potential for arbitrary command execution.

How do I fix CVE-2024-39798?

To mitigate CVE-2024-39798, ensure that your Wavlink AC3000 M33A8 firmware is updated to the latest version that addresses these vulnerabilities.

What type of vulnerability is CVE-2024-39798?

CVE-2024-39798 is classified as an external configuration control vulnerability affecting the openvpn.cgi functionality.

Who is affected by CVE-2024-39798?

Users of the Wavlink AC3000 M33A8 are affected by CVE-2024-39798.

What could an attacker gain by exploiting CVE-2024-39798?

An attacker exploiting CVE-2024-39798 could execute arbitrary commands on the vulnerable Wavlink AC3000 M33A8 device.