CVE-2024-38666

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38666

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

A

n external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

References
Link Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051 Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2051 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:wavlink:wl-wn533a8_firmware:m33a8.v5030.210505:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wl-wn533a8:-:*:*:*:*:*:*:*
History

21 Aug 2025, 18:45

Type Values Removed Values Added
References () https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051 - () https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051 - Exploit, Third Party Advisory
References () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2051 - () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2051 - Exploit, Third Party Advisory
Summary
  • (es) Existe una vulnerabilidad de control de configuración externa en la función openvpn.cgi openvpn_client_setup() de Wavlink AC3000 M33A8.V5030.210505. Una solicitud HTTP manipulada especialmente puede provocar la ejecución de un comando arbitrario. Un atacante puede realizar una solicitud HTTP autenticada para activar esta vulnerabilidad.
CPE cpe:2.3:h:wavlink:wl-wn533a8:-:*:*:*:*:*:*:*
cpe:2.3:o:wavlink:wl-wn533a8_firmware:m33a8.v5030.210505:*:*:*:*:*:*:*
First Time Wavlink
Wavlink wl-wn533a8 Firmware
Wavlink wl-wn533a8

14 Jan 2025, 16:15

Type Values Removed Values Added
References
  • () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2051 -

14 Jan 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-14 15:15

Updated : 2025-08-21 18:45

NVD link : CVE-2024-38666

Mitre link : CVE-2024-38666

CVE.ORG link : CVE-2024-38666

JSON object : View

Products Affected

wavlink

CWE
CWE-15

External Control of System or Configuration Setting