CVE-2024-36272
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary code on Wavlink AC3000 routers via a buffer overflow in the usbip.cgi component. Attackers can gain full system control by sending specially crafted HTTP requests. Only users of specific Wavlink router models with vulnerable firmware are affected.
💻 Affected Systems
- Wavlink AC3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to persistent backdoor installation, credential theft, and router takeover for network attacks
Likely Case
Remote code execution allowing attackers to modify router settings, intercept traffic, or pivot to internal network devices
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent unauthorized access
🎯 Exploit Status
Requires authentication but buffer overflow exploitation is well-understood
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates
2. Download latest firmware for AC3000
3. Upload via router web interface
4. Reboot router after installation
🔧 Temporary Workarounds
Disable USB over IP feature
allDisable the vulnerable usbip.cgi functionality if not needed
Restrict web interface access
linuxLimit access to router administration interface
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Replace vulnerable router with patched or alternative model
- Isolate router in separate VLAN with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About pageCheck Version:
curl -s http://router-ip/cgi-bin/version.cgi or check web interfaceVerify Fix Applied:
Verify firmware version is newer than M33A8.V5030.210505📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /cgi-bin/usbip.cgi
- Multiple authentication attempts followed by buffer overflow patterns
Network Indicators:
- HTTP requests with unusually long parameters to usbip.cgi
- Traffic patterns suggesting exploit attempts
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/usbip.cgi" AND method="POST" AND size>1000)