CVE-2024-39273
Published: 14 January 2025
Summary
CVE-2024-39273 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-5 (Access Restrictions for Change) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2024-39273 is a firmware update vulnerability in the fw_check.sh functionality of the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The issue allows a specially crafted HTTP request to enable arbitrary firmware updates, stemming from missing authentication for a critical function (CWE-306). It carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, high attack complexity, no privileges or user interaction required, and scope change with high impacts across confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit this vulnerability via a man-in-the-middle (MITM) attack by intercepting and altering HTTP traffic to the device. Successful exploitation enables the attacker to perform arbitrary firmware updates, potentially allowing full device compromise, such as installing malicious firmware for persistent control or further network attacks.
Mitigation details are available in the Talos Intelligence advisory (TALOS-2024-2037) at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2037.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38386
Vulnerability details
A firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing auth on firmware update function enables remote exploitation of the router's web interface (T1190) and direct installation of malicious system firmware for persistence (T1542.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Restricts access to firmware update mechanisms to authorized personnel, directly preventing unauthenticated arbitrary firmware updates.
Ensures confidentiality and integrity of firmware update transmissions, mitigating man-in-the-middle exploitation of HTTP traffic.
Monitors and verifies firmware integrity to detect unauthorized changes from malicious firmware installations.