CVE-2024-39602
Published: 14 January 2025
Summary
CVE-2024-39602 is a critical-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 39.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of HTTP request inputs to the nas.cgi set_nas() function to block specially crafted requests leading to arbitrary command execution.
Directly mandates timely identification, reporting, and remediation of the specific flaw in Wavlink AC3000 firmware enabling command injection.
Enforces least privilege to restrict high-privilege (PR:H) authenticated users from executing arbitrary commands via the vulnerable nas.cgi functionality.
NVD Description
An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Deeper analysisAI
CVE-2024-39602 is an external config control vulnerability, classified under CWE-15, in the nas.cgi set_nas() functionality of the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The issue enables arbitrary command execution via a specially crafted HTTP request. Published on January 14, 2025, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity.
The vulnerability can be exploited by an authenticated attacker possessing high privileges (PR:H) who sends a malicious HTTP request over the network (AV:N) with low attack complexity (AC:L). Successful exploitation grants arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability, with a scope change (S:C) that amplifies the effects beyond the vulnerable component.
For mitigation guidance, including any available patches or workarounds, security practitioners should refer to the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2052.
Details
- CWE(s)