CVE-2024-39299
Published: 14 January 2025
Summary
CVE-2024-39299 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 43.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely remediation through patching the identified buffer overflow flaw in the router firmware directly prevents exploitation of CVE-2024-39299.
Validating HTTP request inputs to the qos.cgi qos_sta_settings() function prevents the stack-based buffer overflow triggered by specially crafted requests.
Memory protection mechanisms such as stack canaries and non-executable stacks mitigate exploitation of the stack-based buffer overflow even if input validation fails.
NVD Description
A buffer overflow vulnerability exists in the qos.cgi qos_sta_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Deeper analysisAI
A stack-based buffer overflow vulnerability, designated CVE-2024-39299 and associated with CWE-120, affects the qos.cgi qos_sta_settings() functionality in the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The issue arises when processing a specially crafted HTTP request, leading to a buffer overflow condition that can overwrite stack memory. This vulnerability received a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and potential for high-impact confidentiality, integrity, and availability effects across a changed scope.
An authenticated attacker with high privileges, such as administrative access to the device, can exploit this vulnerability by sending a malicious HTTP request to the qos.cgi endpoint. Successful exploitation enables arbitrary code execution, potentially granting full control over the router, including the ability to execute commands, modify configurations, or pivot to other network resources, given the scope change and high impact ratings.
The primary advisory from Talos Intelligence (TALOS-2024-2048) documents this vulnerability; practitioners should consult it for detailed technical analysis, proof-of-concept details, and recommended mitigations, as no specific patches are detailed in the available CVE information.
Details
- CWE(s)