CVE-2024-38666
Published: 14 January 2025
Summary
CVE-2024-38666 is a critical-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates specially crafted HTTP request inputs to the openvpn_client_setup() function, preventing arbitrary command injection.
Ensures timely remediation of the specific flaw in CVE-2024-38666 via firmware patching or vendor-provided mitigations.
Limits high-privilege access for authenticated users to the vulnerable openvpn.cgi functionality, reducing the attack surface.
NVD Description
An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Deeper analysisAI
CVE-2024-38666 is an external config control vulnerability, classified under CWE-15, affecting the openvpn.cgi openvpn_client_setup() functionality in the Wavlink AC3000 router on firmware version M33A8.V5030.210505. The issue enables a specially crafted HTTP request to result in arbitrary command execution on the device.
Exploitation requires an authenticated attacker with high privileges (PR:H), who can send the malicious HTTP request over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The vulnerability has a CVSS v3.1 base score of 9.1 and a changed scope (S:C), allowing high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) through arbitrary command execution.
Mitigation guidance is available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051.
Details
- CWE(s)