CVE-2024-39756
Published: 14 January 2025
Summary
CVE-2024-39756 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A buffer overflow vulnerability, tracked as CVE-2024-39756 and published on 2025-01-14, affects the adm.cgi rep_as_router() functionality in Wavlink AC3000 routers running firmware version M33A8.V5030.210505. The issue stems from CWE-120 (Buffer Copy without Checking Size of Input), where a specially crafted HTTP request triggers a stack-based buffer overflow. This flaw has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high confidentiality, integrity, and availability impacts with changed scope.
Exploitation requires an authenticated attacker with high privileges (PR:H) to send a malicious HTTP request to the vulnerable component over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation can lead to arbitrary code execution, enabling full compromise of the affected router, including potential data theft, modification of configurations, or denial of service.
Mitigation details are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2024. Security practitioners should consult this report for patch information, workarounds, or firmware updates specific to the Wavlink AC3000 device.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38393
Vulnerability details
A buffer overflow vulnerability exists in the adm.cgi rep_as_router() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web admin interface (adm.cgi) enables authenticated RCE on network device via crafted HTTP request.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents stack-based buffer overflow by validating the size and format of specially crafted HTTP request inputs to the adm.cgi rep_as_router() function.
Implements memory protections such as stack canaries, ASLR, and DEP to block exploitation of stack buffer overflows even with malformed inputs.
Requires timely remediation of the identified buffer overflow flaw through firmware patching or updates specific to Wavlink AC3000 M33A8.V5030.210505.