Where
-Infinity
0

Trending

Last week
Last month
Last year

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() fu…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpnserversetup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the selopenprotocol POST parameter.

First published (updated )
CVE-2024-39798

Wavlink AC3000 M33A8Buffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple buffer overflow vulnerabilities exist in the qos.cgi qossettings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the qosdat POST parameter.

First published (updated )
CVE-2024-39802

Wavlink AC3000 M33A8Buffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple buffer overflow vulnerabilities exist in the qos.cgi qossettings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the qosbandwidth POST parameter.

First published (updated )
CVE-2024-39801

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() fu…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpnserversetup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the selopeninterface POST parameter.

First published (updated )
CVE-2024-39799

Wavlink AC3000 M33A8Buffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple buffer overflow vulnerabilities exist in the qos.cgi qossettings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the selmode POST parameter.

First published (updated )
CVE-2024-39803

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() fu…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpnserversetup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the openport POST parameter.

First published (updated )
CVE-2024-39800

Wavlink AC3000 M33A8Path Traversal

Risk 72
Severity
9.1
Path Traversal
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple directory traversal vulnerabilities exist in the nas.cgi adddir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A directory traversal vulnerability exists within the diskpart POST parameter.

First published (updated )
CVE-2024-39787

Wavlink AC3000Command Injection

Risk 72
Severity
9.1
Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple command execution vulnerabilities exist in the nas.cgi adddir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the adddirname POST parameter.

First published (updated )
CVE-2024-39785

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionalit…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exist in the nas.cgi setnas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the ftpport POST parameter.

First published (updated )
CVE-2024-39794

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionalit…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exist in the nas.cgi setnas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the ftpname POST parameter.

First published (updated )
CVE-2024-39793

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionalit…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exist in the nas.cgi setnas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the ftpmaxsessions POST parameter.

First published (updated )
CVE-2024-39795

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exist in the nas.cgi setftpcfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the ftpname POST parameter.

First published (updated )
CVE-2024-39788

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exist in the nas.cgi setftpcfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the ftpmaxsessions POST parameter.

First published (updated )
CVE-2024-39790

Wavlink AC3000 M33A8Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple external config control vulnerabilities exist in the nas.cgi setftpcfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the ftpport POST parameter.

First published (updated )
CVE-2024-39789

Wavlink AC3000 M33A8Command Injection

Risk 72
Severity
9.1
Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple command execution vulnerabilities exist in the nas.cgi adddir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the diskpart POST parameter.

First published (updated )
CVE-2024-39784

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 72
Severity
9.1
Command Injection, OS Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the adm.cgi schreboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the restartmin POST parameter.

First published (updated )
CVE-2024-39782

Wavlink AC3000 M33A8Buffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple buffer overflow vulnerabilities exist in the internet.cgi setqos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability exists in the enenable POST parameter.

First published (updated )
CVE-2024-39770

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 72
Severity
9.1
Command Injection, OS Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the adm.cgi schreboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the restartweek POST parameter.

First published (updated )
CVE-2024-39783

Wavlink AC3000 M33A8Buffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple buffer overflow vulnerabilities exist in the internet.cgi setqos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability exists in the climac POST parameter.

First published (updated )
CVE-2024-39769

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 72
Severity
9.1
Command Injection, OS Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the adm.cgi schreboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the restarthour POST parameter.

First published (updated )
CVE-2024-39781

Wavlink AC3000 M33A8Buffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple buffer overflow vulnerabilities exist in the internet.cgi setqos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability exists in the cliname POST parameter.

First published (updated )
CVE-2024-39768

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 87
Severity
10
Command Injection, OS Command Injection
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists within the restartweekvalue POST parameter.

First published (updated )
CVE-2024-39761

Wavlink AC3000Command Injection, OS Command Injection

Risk 72
Severity
9.1
Command Injection, OS Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the custominterface POST parameter.

First published (updated )
CVE-2024-39765

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 87
Severity
10
Command Injection, OS Command Injection
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists within the restartminvalue POST parameter.

First published (updated )
CVE-2024-39760

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 72
Severity
9.1
Command Injection, OS Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the gateway POST parameter.

First published (updated )
CVE-2024-39763

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 72
Severity
9.1
Command Injection, OS Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the dest POST parameter.

First published (updated )
CVE-2024-39764

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 72
Severity
9.1
Command Injection, OS Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the internet.cgi setaddrouting() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the netmask POST parameter.

First published (updated )
CVE-2024-39762

Wavlink AC3000 M33A8Command Injection, OS Command Injection

Risk 87
Severity
10
Command Injection, OS Command Injection
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Multiple OS command injection vulnerabilities exist in the login.cgi setsysinit() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists within the restarthourvalue POST parameter.

First published (updated )
CVE-2024-39759

Wavlink AC3000 M33A8XSS

Risk 80
Severity
9.6
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

A cross-site scripting (xss) vulnerability exists in the login.cgi setlangCountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2024-39363

Wavlink AC3000 M33A8An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M3…

Risk 27
Severity
5.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.

First published (updated )
CVE-2024-39773

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203