CVE-2024-10194
📋 TL;DR
A critical stack-based buffer overflow vulnerability in WAVLINK routers allows attackers to execute arbitrary code by manipulating the wlanUrl parameter in the login.cgi authentication page. This affects WAVLINK WN530H4, WN530HG4, and WN572HG3 models up to October 28, 2022. Attackers must be on the local network to exploit this vulnerability.
💻 Affected Systems
- WAVLINK WN530H4
- WAVLINK WN530HG4
- WAVLINK WN572HG3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise leading to persistent backdoor installation, credential theft, and pivot point for attacking other internal network devices.
Likely Case
Router takeover allowing traffic interception, DNS manipulation, and network disruption.
If Mitigated
Limited impact if devices are isolated or have strict network segmentation preventing lateral movement.
🎯 Exploit Status
Exploit has been publicly disclosed and requires only local network access; no authentication needed to trigger the buffer overflow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider replacing affected devices with supported models.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected routers from critical network segments to limit potential damage.
Access Control Lists
allRestrict access to the router's web interface to trusted IP addresses only.
🧯 If You Can't Patch
- Replace affected WAVLINK routers with supported models from vendors that provide security updates
- Implement strict network monitoring for unusual traffic patterns or authentication attempts to the router
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at System Status or About page; if version date is 20221028 or earlier, device is vulnerable.Check Version:
No CLI command available; check via web interface at http://[router-ip]/Verify Fix Applied:
No fix available to verify; replacement with non-vulnerable device is the only verification method.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to login.cgi with long wlanUrl parameters
- Multiple failed authentication attempts followed by buffer overflow patterns
Network Indicators:
- Unusual outbound connections from router to unknown IPs
- DNS queries to suspicious domains originating from router
SIEM Query:
source_ip=router_ip AND (uri_path="/login.cgi" AND http_method="POST" AND uri_query CONTAINS "wlanUrl=" AND uri_query LENGTH > 500)