Cyber Resilience

CVE-2024-39288

CriticalPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
21 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.1484 94.7th percentile
Risk Priority 27 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-39288 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of the Wavlink AC3000 router with firmware version M33A8.V5030.210505. The flaw is a stack-based buffer overflow (CWE-120) that can be reached through the device's web interface and carries a CVSS 3.1 score of 9.1.

An authenticated attacker can send a specially crafted HTTP request to trigger the overflow. Successful exploitation grants the attacker the ability to corrupt stack memory and achieve impacts rated high for confidentiality, integrity, and availability, with the scope changed to affect resources beyond the vulnerable component.

Public analysis of the issue is available in detailed reports published by Talos Intelligence under TALOS-2024-2021. The current EPSS score stands at 0.1484 with no material increase from its recorded peak.

EU & UK References

Vulnerability details

A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CWE(s)
CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Stack buffer overflow in authenticated web CGI (internet.cgi) enables remote code execution via crafted HTTP requests (T1190) and facilitates privilege escalation due to changed scope and high impacts (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-39802Same product: Wavlink Wl-Wn533A8
CVE-2024-37357Same product: Wavlink Wl-Wn533A8
CVE-2024-39803Same product: Wavlink Wl-Wn533A8
CVE-2024-37184Same product: Wavlink Wl-Wn533A8
CVE-2024-39768Same product: Wavlink Wl-Wn533A8
CVE-2024-36290Same product: Wavlink Wl-Wn533A8
CVE-2024-39756Same product: Wavlink Wl-Wn533A8
CVE-2024-39370Same product: Wavlink Wl-Wn533A8
CVE-2024-36272Same product: Wavlink Wl-Wn533A8
CVE-2024-39801Same product: Wavlink Wl-Wn533A8

Affected Assets

wavlink
wl-wn533a8 firmware
m33a8.v5030.210505

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of HTTP request inputs to internet.cgi's set_add_routing() to block specially crafted requests causing stack-based buffer overflow.

SI-16 Memory Protection good match
prevent

Implements memory protections like stack canaries or ASLR to mitigate stack-based buffer overflows triggered by malformed HTTP inputs.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and correction of the buffer overflow flaw in Wavlink AC3000 firmware's internet.cgi component.

References