CVE-2024-21797

The vulnerability affects the set_TR069() function in the adm.cgi file that handles the device's administrative panel. Sending an appropriately crafted HTTP request to this endpoint causes unverified commands to be executed at the operating system level of the device (command injection, CWE-74). Exploitation of the vulnerability requires authentication, but once obtained, the attacker can inject and execute arbitrary code without further restrictions. The vulnerability has scope that extends beyond the application context (Scope: Changed), which means the ability to affect resources outside the web application itself.

Successful exploitation of the vulnerability allows an attacker to gain full control over the device, including reading and modifying configuration data, persistent disruption of network services availability, and potential use of the router as an entry point to the local network.

Patches available from the manufacturer should be applied in accordance with the references. Additionally, it is recommended to restrict access to the device's administrative panel exclusively to trusted IP addresses and to avoid exposing the management interface directly to the Internet.

Wavlink AC3000 M33A8, firmware version V5030.210505 (products: Wavlink WL-WN533A8 / WL-WN533A8 Firmware)