Cyber Resilience

CVE-2024-39774

CriticalPublic PoC

Published: 14 January 2025

Published
14 January 2025
Modified
22 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0112 78.6th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-39774 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2024-39774 is a stack-based buffer overflow vulnerability in the set_sys_adm() functionality of adm.cgi within the Wavlink AC3000 firmware version M33A8.V5030.210505. The issue arises from a specially crafted HTTP request that overflows the buffer, potentially allowing arbitrary code execution.

An attacker with high privileges (PR:H) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Exploitation changes scope (S:C) and results in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 9.1.

Mitigation details are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2030.

EU & UK References

Vulnerability details

A buffer overflow vulnerability exists in the adm.cgi set_sys_adm() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CWE(s)
CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Stack-based buffer overflow in adm.cgi web interface enables remote code execution on a public-facing network device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-39803Same product: Wavlink Wl-Wn533A8
CVE-2024-37184Same product: Wavlink Wl-Wn533A8
CVE-2024-39768Same product: Wavlink Wl-Wn533A8
CVE-2024-36290Same product: Wavlink Wl-Wn533A8
CVE-2024-39756Same product: Wavlink Wl-Wn533A8
CVE-2024-39370Same product: Wavlink Wl-Wn533A8
CVE-2024-36272Same product: Wavlink Wl-Wn533A8
CVE-2024-39801Same product: Wavlink Wl-Wn533A8
CVE-2024-39770Same product: Wavlink Wl-Wn533A8
CVE-2024-39769Same product: Wavlink Wl-Wn533A8

Affected Assets

wavlink
wl-wn533a8 firmware
m33a8.v5030.210505

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the stack-based buffer overflow flaw in adm.cgi's set_sys_adm() function through timely firmware patching and flaw monitoring.

SI-10 Information Input Validation good match
prevent

Prevents exploitation by validating specially crafted HTTP request inputs that trigger the buffer overflow in set_sys_adm().

SI-16 Memory Protection good match
prevent

Mitigates arbitrary code execution from the stack-based buffer overflow using memory protections like stack canaries and non-executable memory.

References