CVE-2024-34166
Published: 14 January 2025
Summary
CVE-2024-34166 is a critical-severity Command Injection (CWE-77) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
An OS command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of the Wavlink AC3000 router running firmware M33A8.V5030.210505. The flaw, tracked as CVE-2024-34166 and assigned CWE-77, permits arbitrary code execution when an attacker supplies a specially crafted sequence of HTTP requests to the affected endpoint. It carries a CVSS 3.1 base score of 10.0 reflecting network attack vector, low complexity, no required credentials or user interaction, and changed scope with high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the issue simply by sending malicious HTTP requests to the device, resulting in execution of arbitrary operating-system commands with the privileges of the web server process. The current and peak EPSS scores both stand at 0.1015, indicating moderate but stable exploitation probability since disclosure.
Public advisories from Talos Intelligence detail the vulnerability and are available at the referenced URLs.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-35163
Vulnerability details
An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of HTTP requests can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated OS command injection in a network-exposed CGI endpoint on a router directly enables remote exploitation of a public-facing application for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates HTTP request inputs to the touchlist_sync.cgi script's touchlistsync() function to block specially crafted payloads that enable OS command injection.
Remediates the specific OS command injection flaw in the Wavlink router firmware by applying patches or code corrections.
Restricts HTTP inputs to the vulnerable CGI endpoint to authorized formats and lengths, mitigating injection attempts.