CVE-2024-39358
Published: 14 January 2025
Summary
CVE-2024-39358 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2024-39358 is a stack-based buffer overflow vulnerability in the adm.cgi set_wzap() functionality of the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The flaw, classified under CWE-120, arises when processing a specially crafted HTTP request, leading to a buffer overflow condition. It was published on January 14, 2025, and carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation across confidentiality, integrity, and availability.
An authenticated attacker with high privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By sending a malicious HTTP request to the affected adm.cgi endpoint, the attacker triggers the stack-based buffer overflow, potentially achieving arbitrary code execution, full system compromise, or denial of service, with a scope change that extends impact beyond the vulnerable component.
Details on mitigation, including any available patches or workarounds, are documented in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2027. Security practitioners should consult this report for vendor-specific remediation guidance and verify firmware updates for the Wavlink AC3000 device.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38389
Vulnerability details
A buffer overflow vulnerability exists in the adm.cgi set_wzap() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in router's public adm.cgi HTTP endpoint directly enables remote exploitation of a public-facing web application for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of HTTP request inputs to the adm.cgi set_wzap() function to prevent stack-based buffer overflows from specially crafted requests.
Mandates timely identification, reporting, and patching of flaws like this buffer overflow vulnerability in router firmware.
Implements memory protections such as stack canaries and address space layout randomization to mitigate exploitation of stack-based buffer overflows.