CVE-2024-39800: Critical severity wavlink jetstream ac3000 vulnerability

Published Jan 14, 2025

Updated

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpnserversetup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the openport POST parameter.

Affected Software

3 affected components

Wavlink AC3000 M33A8=V5030.210505

All of the following

Wavlink Wl-wn533a8 Firmware=m33a8.v5030.210505

Wavlink WL-WN533A8

Event History

Jan 14, 2025

CVE Published

via MITRE·02:21 PM

Data Sourced

via MITRE·02:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-39800?

CVE-2024-39800 is considered a critical vulnerability due to its potential for arbitrary command execution.

How do I fix CVE-2024-39800?

To fix CVE-2024-39800, update the Wavlink AC3000 M33A8 to the latest firmware version that addresses this vulnerability.

Who is affected by CVE-2024-39800?

CVE-2024-39800 affects users of the Wavlink AC3000 M33A8 running the firmware version V5030.210505.

What type of attack can exploit CVE-2024-39800?

CVE-2024-39800 can be exploited through specially crafted HTTP requests that lead to arbitrary command execution.

Is authentication required to exploit CVE-2024-39800?

Yes, an attacker must make an authenticated HTTP request to exploit CVE-2024-39800.