CVE-2024-37357
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary code on Wavlink AC3000 routers by sending a specially crafted HTTP request that triggers a stack-based buffer overflow. Attackers with access to the admin interface can exploit this to gain full control of affected devices. Only Wavlink AC3000 routers running specific vulnerable firmware versions are affected.
💻 Affected Systems
- Wavlink AC3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network pivoting, credential theft, and botnet recruitment.
Likely Case
Local network attacker gains administrative control of router, enabling traffic interception, DNS manipulation, and lateral movement.
If Mitigated
Isolated impact limited to router compromise if network segmentation prevents lateral movement and external access is blocked.
🎯 Exploit Status
Requires authentication but buffer overflow exploitation is well-understood. No public exploit code available at disclosure time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates. 2. Download latest firmware for AC3000. 3. Log into router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router after update completes.
🔧 Temporary Workarounds
Disable TR069 remote management
allDisable the TR069 protocol functionality that contains the vulnerable set_TR069() function
Change default admin credentials
allChange default admin password to strong, unique credentials to prevent authentication
Restrict admin interface access
allBlock external access to admin interface and restrict to trusted internal IPs only
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for unusual HTTP requests to adm.cgi endpoint
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Status or Firmware Update sectionCheck Version:
Login to router web interface and navigate to System Information pageVerify Fix Applied:
Verify firmware version is newer than M33A8.V5030.210505 and test TR069 functionality📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /cgi-bin/adm.cgi
- Multiple failed authentication attempts followed by successful login
- Large payloads in TR069-related requests
Network Indicators:
- HTTP traffic to router on non-standard ports
- Unusual outbound connections from router after exploitation
- TR069 protocol traffic from unexpected sources
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/adm.cgi" OR method="POST" AND uri CONTAINS "adm.cgi") AND size>1024