CVE-2024-36295
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on Wavlink AC3000 routers via a crafted HTTP request to the qos.cgi endpoint. Attackers with network access to the router's web interface can gain full system control. Only users of specific Wavlink router models with vulnerable firmware are affected.
💻 Affected Systems
- Wavlink AC3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and brick the device.
Likely Case
Attackers gaining shell access to modify router settings, steal credentials, or use the router as a foothold for further attacks.
If Mitigated
Limited impact if strong network segmentation, authentication controls, and web interface restrictions are in place.
🎯 Exploit Status
Exploit requires authentication but is straightforward to execute once authenticated. Public technical details available in Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates. 2. Download latest firmware for AC3000. 3. Log into router web interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable QoS Web Interface
allDisable or restrict access to the QoS functionality in router settings
Change Default Credentials
allChange router admin password from default to strong unique password
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Disable remote administration and restrict web interface to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About pageCheck Version:
Login to router web interface and check firmware version in system settingsVerify Fix Applied:
Verify firmware version is newer than M33A8.V5030.210505📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /cgi-bin/qos.cgi
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- HTTP requests with command injection patterns to router IP
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/qos.cgi" OR uri="/qos.cgi") AND method="POST"