CVE-2024-38666

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38666
An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051 Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2051 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:wavlink:wl-wn533a8_firmware:m33a8.v5030.210505:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wl-wn533a8:-:*:*:*:*:*:*:*
History

21 Aug 2025, 18:45

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de control de configuración externa en la función openvpn.cgi openvpn_client_setup() de Wavlink AC3000 M33A8.V5030.210505. Una solicitud HTTP manipulada especialmente puede provocar la ejecución de un comando arbitrario. Un atacante puede realizar una solicitud HTTP autenticada para activar esta vulnerabilidad.
First Time Wavlink wl-wn533a8
Wavlink
Wavlink wl-wn533a8 Firmware
References () https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051 - () https://talosintelligence.com/vulnerability_reports/TALOS-2024-2051 - Exploit, Third Party Advisory
References () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2051 - () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2051 - Exploit, Third Party Advisory
CPE cpe:2.3:o:wavlink:wl-wn533a8_firmware:m33a8.v5030.210505:*:*:*:*:*:*:*
cpe:2.3:h:wavlink:wl-wn533a8:-:*:*:*:*:*:*:*

14 Jan 2025, 16:15

Type Values Removed Values Added
References
  • () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2051 -

14 Jan 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-14 15:15

Updated : 2025-08-21 18:45

NVD link : CVE-2024-38666

Mitre link : CVE-2024-38666

CVE.ORG link : CVE-2024-38666

JSON object : View

Products Affected

wavlink

  • wl-wn533a8_firmware
  • wl-wn533a8
CWE
CWE-15

External Control of System or Configuration Setting