Cyber Posture

CVE-2024-38666

CriticalPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
21 August 2025
KEV Added
Patch
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0585 90.6th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-38666 is a critical-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).

Operationally, ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly validates specially crafted HTTP request inputs to the openvpn_client_setup() function, preventing arbitrary command injection.

prevent

Ensures timely remediation of the specific flaw in CVE-2024-38666 via firmware patching or vendor-provided mitigations.

prevent

Limits high-privilege access for authenticated users to the vulnerable openvpn.cgi functionality, reducing the attack surface.

NVD Description

An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Deeper analysisAI

CVE-2024-38666 is an external config control vulnerability, classified under CWE-15, affecting the openvpn.cgi openvpn_client_setup() functionality in the Wavlink AC3000 router on firmware version M33A8.V5030.210505. The issue enables a specially crafted HTTP request to result in arbitrary command execution on the device.

Exploitation requires an authenticated attacker with high privileges (PR:H), who can send the malicious HTTP request over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The vulnerability has a CVSS v3.1 base score of 9.1 and a changed scope (S:C), allowing high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) through arbitrary command execution.

Mitigation guidance is available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051.

Details

CWE(s)

Affected Products

wavlink
wl-wn533a8 firmware
m33a8.v5030.210505

CVEs Like This One

CVE-2024-39794Same product: Wavlink Wl-Wn533A8
CVE-2024-39800Same product: Wavlink Wl-Wn533A8
CVE-2024-39602Same product: Wavlink Wl-Wn533A8
CVE-2024-39280Same product: Wavlink Wl-Wn533A8
CVE-2024-39795Same product: Wavlink Wl-Wn533A8
CVE-2024-39798Same product: Wavlink Wl-Wn533A8
CVE-2024-39788Same product: Wavlink Wl-Wn533A8
CVE-2024-39789Same product: Wavlink Wl-Wn533A8
CVE-2024-39799Same product: Wavlink Wl-Wn533A8
CVE-2024-39793Same product: Wavlink Wl-Wn533A8

References