CVE-2024-39602
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on Wavlink AC3000 routers by sending specially crafted HTTP requests to the nas.cgi set_nas() functionality. Attackers with access to the router's web interface can achieve remote code execution. Only users of specific Wavlink AC3000 router models with vulnerable firmware are affected.
💻 Affected Systems
- Wavlink AC3000 M33A8
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to install persistent malware, intercept all network traffic, pivot to internal networks, and use the device as part of a botnet.
Likely Case
Attackers with access to the router's web interface gain full control of the device, potentially stealing credentials, redirecting DNS, or deploying cryptocurrency miners.
If Mitigated
With proper network segmentation and access controls, impact is limited to the router itself without lateral movement to other systems.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. The Talos report includes technical details that could be weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
1. Check Wavlink website for firmware updates
2. If update available, download and install via web interface
3. Monitor for official patch release
🔧 Temporary Workarounds
Disable NAS functionality
allTurn off NAS features in router configuration if not needed
Restrict web interface access
allLimit access to router admin interface to trusted IPs only
🧯 If You Can't Patch
- Isolate affected routers in separate network segment with strict firewall rules
- Change default admin credentials and implement strong authentication
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About pageCheck Version:
Check via web interface or SSH if enabled: cat /etc/versionVerify Fix Applied:
Verify firmware version is newer than V5030.210505📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /cgi-bin/nas.cgi
- Multiple failed login attempts followed by successful login and NAS configuration changes
Network Indicators:
- HTTP requests with unusual parameters to set_nas() endpoint
- Outbound connections from router to unexpected destinations
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/nas.cgi" AND method="POST" AND params CONTAINS "set_nas")