Cyber Resilience

CVE-2024-38895

Wavlink Wn551K1 Firmware

Public PoC
Published
24 June 2024
Modified
06 June 2025
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0039 32th percentile
Risk Priority 44 floored blend · peak EPSS

Summary

CVE-2024-38895 is a medium-severity Exposure of Sensitive Information Through Data Queries (CWE-202) vulnerability in Wavlink Wn551K1 Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-23 (Data Mining Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.

CWE(s)
CWE-202

Related Threats

MITRE ATT&CK Enterprise Techniques

T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-38892Same product: Wavlink Wn551K1
CVE-2024-38897Same product: Wavlink Wn551K1
CVE-2024-38896Same product: Wavlink Wn551K1
CVE-2024-38894Same product: Wavlink Wn551K1
CVE-2025-64528Shared CWE-202
CVE-2025-36575Shared CWE-202
CVE-2023-1625Shared CWE-202
CVE-2024-2088Shared CWE-202
CVE-2025-29981Shared CWE-202
CVE-2023-20215Shared CWE-202

Affected Assets

wavlink
wn551k1 firmware
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-23 Data Mining Protection good match

AC-23 directly requires mechanisms to protect against unauthorized data mining and inference from statistical queries that would expose sensitive information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Least-privilege query permissions directly limit the data an attacker can request or infer.

DE.CM-03 partial match
prevents

Behavior analytics on query activity can detect inference attempts but does not prevent exposure at query time.

PR.DS-10 partial match
prevents

Protecting data-in-use reduces what remains available for inference via queries.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control mostly match
prevents

Access control limits who can run queries that could expose sensitive information via inference.

A.5.18 Access rights mostly match
prevents

Granular access rights reduce the ability of users to craft inference queries.

A.8.11 Data masking mostly match
prevents

Data masking prevents inference by obscuring sensitive values returned in query results.

A.8.3 Information access restriction mostly match
prevents

Information access restriction directly limits query scope that could lead to inference.

A.5.12 Classification of information partial match
mitigates

Classification helps identify sensitive data that must be protected from inference attacks.

A.8.12 Data leakage prevention partial match
finds

DLP can detect and block queries or result sets that risk exposing sensitive information.

References