CVE-2024-34544
📋 TL;DR
This CVE describes a command injection vulnerability in the Wavlink AC3000 router's wireless.cgi AddMac() function. An authenticated attacker can execute arbitrary commands on the device by sending a specially crafted HTTP request. This affects users of Wavlink AC3000 routers with vulnerable firmware.
💻 Affected Systems
- Wavlink AC3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.
Likely Case
Attacker gains shell access to execute commands, potentially stealing credentials, modifying configurations, or launching attacks against internal systems.
If Mitigated
With proper network segmentation and access controls, impact limited to the router itself without lateral movement.
🎯 Exploit Status
Exploit requires authentication but is straightforward once authenticated. Public technical details available in Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates. 2. Download latest firmware. 3. Log into router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router web interface
Change default credentials
allUse strong unique passwords for admin access
🧯 If You Can't Patch
- Segment router on isolated network segment
- Implement strict firewall rules to limit access to router management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System Status or About pageCheck Version:
curl -s http://router-ip/cgi-bin/wireless.cgi | grep versionVerify Fix Applied:
Verify firmware version is newer than M33A8.V5030.210505📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to wireless.cgi with shell metacharacters
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- HTTP requests containing shell commands in parameters
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/wireless.cgi" AND (param="AddMac" AND (value="*;*" OR value="*|*" OR value="*`*")))