CVE-2024-39784
📋 TL;DR
This CVE describes multiple command injection vulnerabilities in the Wavlink AC3000 router's nas.cgi add_dir() functionality. An authenticated attacker can send specially crafted HTTP requests to execute arbitrary commands on the device. This affects Wavlink AC3000 M33A8.V5030.210505 firmware users.
💻 Affected Systems
- Wavlink AC3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, pivot to internal networks, steal credentials, or use device as botnet node.
Likely Case
Attacker gains shell access to router, modifies configurations, intercepts network traffic, or installs malware.
If Mitigated
Limited impact due to network segmentation, strong authentication controls, and restricted administrative access.
🎯 Exploit Status
Exploitation requires authentication but command injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink support for firmware updates. 2. Download latest firmware. 3. Backup configuration. 4. Upload firmware via web interface. 5. Reboot device.
🔧 Temporary Workarounds
Disable web administration
allDisable remote web administration interface
Network segmentation
allIsolate router on separate VLAN with restricted access
🧯 If You Can't Patch
- Change default credentials and implement strong authentication
- Restrict administrative access to specific IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: System Status > Firmware VersionCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version is newer than M33A8.V5030.210505📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to nas.cgi
- Multiple failed authentication attempts followed by successful login
- Commands in disk_part parameter
Network Indicators:
- HTTP POST requests to /cgi-bin/nas.cgi with shell metacharacters
- Outbound connections from router to unusual destinations
SIEM Query:
source="router_logs" AND uri="/cgi-bin/nas.cgi" AND method="POST" AND (param="disk_part" AND value CONTAINS "|" OR value CONTAINS ";" OR value CONTAINS "`" OR value CONTAINS "$")