Cyber Resilience

CVE-2024-37357

CriticalPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
21 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.1438 94.6th percentile
Risk Priority 27 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37357 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of the Wavlink AC3000 router running firmware M33A8.V5030.210505. The flaw is a stack-based buffer overflow (CWE-120) that can be triggered by a specially crafted HTTP request, carrying a CVSS 3.1 score of 9.1.

An authenticated attacker with network access can send a malicious HTTP request to the affected endpoint, resulting in arbitrary code execution or a crash that impacts confidentiality, integrity, and availability with scope change.

Detailed technical analysis and any available remediation guidance are provided in the Talos reports at the referenced URLs. The EPSS score has remained flat at 0.1438 with no material increase observed since disclosure.

EU & UK References

Vulnerability details

A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CWE(s)
CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in public router web CGI (adm.cgi) via crafted HTTP request enables RCE after auth, directly mapping to public-facing app exploitation and potential priv esc to root/system compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-39802Same product: Wavlink Wl-Wn533A8
CVE-2024-39288Same product: Wavlink Wl-Wn533A8
CVE-2024-39803Same product: Wavlink Wl-Wn533A8
CVE-2024-37184Same product: Wavlink Wl-Wn533A8
CVE-2024-39768Same product: Wavlink Wl-Wn533A8
CVE-2024-36290Same product: Wavlink Wl-Wn533A8
CVE-2024-39756Same product: Wavlink Wl-Wn533A8
CVE-2024-39370Same product: Wavlink Wl-Wn533A8
CVE-2024-36272Same product: Wavlink Wl-Wn533A8
CVE-2024-39801Same product: Wavlink Wl-Wn533A8

Affected Assets

wavlink
wl-wn533a8 firmware
m33a8.v5030.210505

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Information Input Validation directly prevents buffer overflows by enforcing bounds checking and sanitization on crafted HTTP inputs to the adm.cgi set_TR069() function.

SI-16 Memory Protection good match
prevent

Memory Protection mechanisms like stack canaries, ASLR, and DEP mitigate exploitation of the stack-based buffer overflow even if invalid input reaches the vulnerable code.

SI-2 Flaw Remediation good match
prevent

Flaw Remediation ensures timely patching of the specific buffer overflow vulnerability in the Wavlink AC3000 firmware, eliminating the root cause.

References