CVE-2024-39608
Published: 14 January 2025
Summary
CVE-2024-39608 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-5 (Access Restrictions for Change).
Deeper analysis
CVE-2024-39608 is a firmware update vulnerability in the login.cgi functionality of the Wavlink AC3000 router running firmware version M33A8.V5030.210505. The issue stems from CWE-306 (Missing Authentication for Critical Function), where a specially crafted HTTP request enables arbitrary firmware updates without proper validation. This flaw has a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, lack of privileges or user interaction required, and potential for scope change with high impacts across confidentiality, integrity, and availability.
Any unauthenticated attacker with network access to the affected device can exploit this vulnerability by sending a malicious HTTP request to the login.cgi endpoint, triggering an arbitrary firmware update. Successful exploitation allows the attacker to install malicious firmware, potentially leading to full device compromise, persistent access, data theft, or use as a pivot point in the network.
Mitigation details are provided in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2036, which documents the vulnerability and recommends applying vendor patches or firmware updates when available, along with network segmentation and exposure controls for the affected devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38369
Vulnerability details
A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can send an unauthenticated message to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated exploitation of public web endpoint (login.cgi) enables arbitrary malicious firmware installation for persistence.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access Enforcement requires logical access authorizations, directly preventing unauthenticated arbitrary firmware updates via login.cgi.
Access Restrictions for Change limits firmware updates to authorized roles and processes, mitigating unauthorized HTTP-triggered updates.
Software, Firmware, and Information Integrity monitors and verifies firmware against unauthorized changes from malicious updates.