Cyber Resilience

CVE-2024-38666

CriticalPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
21 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0585 90.8th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-38666 is a critical-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-38666 is an external config control vulnerability in the openvpn.cgi openvpn_client_setup() function of the Wavlink AC3000 router running firmware M33A8.V5030.210505. A specially crafted HTTP request can be used to inject configuration values that result in arbitrary command execution on the device.

An attacker who has already obtained administrative credentials can send an authenticated HTTP request to the affected CGI endpoint and achieve full command execution. The vulnerability carries a CVSS 3.1 score of 9.1, reflecting network-accessible attack vector, low attack complexity, high impact on confidentiality, integrity, and availability, and a scope change that affects the underlying system.

The associated EPSS score remains low, with a current value of 0.0585 and a peak of 0.0606, indicating no significant post-disclosure increase in observed exploitation activity.

EU & UK References

Vulnerability details

An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CWE(s)
CWE-15

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Direct arbitrary command execution via crafted HTTP request to public-facing CGI on network device maps to exploitation of public-facing application and Unix shell command interpreter.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-39280Same product: Wavlink Wl-Wn533A8
CVE-2024-39800Same product: Wavlink Wl-Wn533A8
CVE-2024-39793Same product: Wavlink Wl-Wn533A8
CVE-2024-39799Same product: Wavlink Wl-Wn533A8
CVE-2024-39788Same product: Wavlink Wl-Wn533A8
CVE-2024-39790Same product: Wavlink Wl-Wn533A8
CVE-2024-39794Same product: Wavlink Wl-Wn533A8
CVE-2024-39789Same product: Wavlink Wl-Wn533A8
CVE-2024-39795Same product: Wavlink Wl-Wn533A8
CVE-2024-39602Same product: Wavlink Wl-Wn533A8

Affected Assets

wavlink
wl-wn533a8 firmware
m33a8.v5030.210505

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly validates specially crafted HTTP request inputs to the openvpn_client_setup() function, preventing arbitrary command injection.

SI-2 Flaw Remediation good match
prevent

Ensures timely remediation of the specific flaw in CVE-2024-38666 via firmware patching or vendor-provided mitigations.

AC-6 Least Privilege partial match
prevent

Limits high-privilege access for authenticated users to the vulnerable openvpn.cgi functionality, reducing the attack surface.

References