CVE-2024-39764
📋 TL;DR
This CVE describes multiple OS command injection vulnerabilities in Wavlink AC3000 routers that allow authenticated attackers to execute arbitrary commands via specially crafted HTTP requests. The vulnerability affects the internet.cgi set_add_routing() functionality and can be exploited through the 'dest' POST parameter. This impacts organizations and individuals using vulnerable Wavlink AC3000 routers.
💻 Affected Systems
- Wavlink AC3000 M33A8
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to establish persistent access, pivot to internal networks, intercept traffic, or use the device as part of a botnet.
Likely Case
Attackers gaining administrative control of the router to modify configurations, intercept network traffic, or deploy malware to connected devices.
If Mitigated
Limited impact due to network segmentation, strong authentication controls, and restricted administrative access to the router interface.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. The vulnerability is in a CGI script accessible via HTTP.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates. 2. Download latest firmware for AC3000. 3. Access router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router after update.
🔧 Temporary Workarounds
Restrict Administrative Access
linuxLimit access to router admin interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Change Default Credentials
allEnsure strong, unique administrative credentials are set
🧯 If You Can't Patch
- Segment the router on a dedicated VLAN with strict firewall rules
- Implement network monitoring for unusual HTTP requests to the router admin interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is V5030.210505 or earlier, assume vulnerable.Check Version:
curl -s http://router-ip/status.cgi | grep firmware_versionVerify Fix Applied:
Verify firmware version has been updated to a version later than V5030.210505📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to internet.cgi with shell metacharacters in parameters
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- HTTP requests containing shell commands in POST parameters
- Outbound connections from router to unexpected external IPs
SIEM Query:
source="router_logs" AND (url="*internet.cgi*" AND (param="*dest=*;*" OR param="*dest=*|*" OR param="*dest=*&*"))