CVE-2024-37184
📋 TL;DR
A buffer overflow vulnerability in the Wavlink AC3000 router's adm.cgi component allows authenticated attackers to execute arbitrary code via crafted HTTP requests. This affects users of Wavlink AC3000 routers with vulnerable firmware. Successful exploitation could lead to complete device compromise.
💻 Affected Systems
- Wavlink AC3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, network traffic interception, credential theft, and lateral movement to connected devices.
Likely Case
Router takeover enabling DNS hijacking, traffic redirection, and persistent backdoor installation.
If Mitigated
Limited impact if strong authentication and network segmentation prevent attacker access to admin interface.
🎯 Exploit Status
Exploit requires authentication but buffer overflow techniques are well understood. Public PoC exists in Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates. 2. Download latest firmware. 3. Log into router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable remote admin access
allPrevent external access to admin interface
Login to router admin panel
Navigate to Remote Management/Admin settings
Disable remote access/WAN administration
Change admin credentials
allUse strong, unique admin password
Login to router admin panel
Navigate to Administration/Password settings
Set strong password (12+ chars, mixed case, numbers, symbols)
🧯 If You Can't Patch
- Segment router on isolated network segment with strict firewall rules
- Implement network monitoring for suspicious HTTP requests to adm.cgi
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status or Firmware Update sectionCheck Version:
Login to router web interface and check firmware version in system settingsVerify Fix Applied:
Verify firmware version is newer than M33A8.V5030.210505📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /cgi-bin/adm.cgi
- Multiple failed login attempts followed by successful login and adm.cgi access
Network Indicators:
- HTTP traffic to router on port 80/443 containing crafted rep_as_bridge parameters
- Unusual outbound connections from router
SIEM Query:
source_ip=router_ip AND (uri_path="/cgi-bin/adm.cgi" OR http_user_agent CONTAINS "exploit")