CVE-2024-39367
📋 TL;DR
This CVE describes an authenticated OS command injection vulnerability in the Wavlink AC3000 router's firewall.cgi functionality. Attackers with valid credentials can execute arbitrary commands with root privileges, potentially compromising the entire device. Only users of the specific Wavlink AC3000 model with vulnerable firmware are affected.
💻 Affected Systems
- Wavlink AC3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, pivot to internal networks, intercept all traffic, or brick the device.
Likely Case
Attacker gains root shell access to the router, enabling traffic interception, credential theft, and lateral movement to connected devices.
If Mitigated
Limited impact if strong authentication controls prevent unauthorized access and network segmentation isolates the router.
🎯 Exploit Status
Exploit requires authentication but is trivial to execute once credentials are obtained. Public PoC available in Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check Wavlink website for firmware updates. If update exists, download and flash via web interface.
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to web interface
Navigate to router admin interface > Advanced > Remote Management > Disable
Change default credentials
allUse strong unique password for admin account
Navigate to router admin interface > System > Password > Set strong password
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious HTTP requests to firewall.cgi
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under System > Firmware. If version is M33A8.V5030.210505, device is vulnerable.Check Version:
curl -s http://router-ip/cgi-bin/firmware.cgi | grep versionVerify Fix Applied:
Verify firmware version has been updated to a version later than M33A8.V5030.210505.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /cgi-bin/firewall.cgi with shell metacharacters in parameters
- Unusual command execution in system logs
Network Indicators:
- HTTP traffic to router containing pipe characters or semicolons in POST data
- Outbound connections from router to unexpected destinations
SIEM Query:
source="router-logs" AND uri="/cgi-bin/firewall.cgi" AND (data CONTAINS "|" OR data CONTAINS ";" OR data CONTAINS "`")