CVE-2024-39799

The vulnerability lies in improper validation of input data passed through the POST parameter named `sel_open_interface` to the openvpn_server_setup() function in the openvpn.cgi script. An attacker can submit a specially crafted HTTP request containing malicious configuration values, which are then processed without proper sanitization. This leads to external configuration injection (CWE-15), resulting in the execution of arbitrary commands in the context of the device's operating system. The attack requires authentication; however, once obtained, it can be carried out remotely without user interaction.

A successful attack allows the attacker to remotely execute arbitrary system commands (RCE) on the device with potential full takeover of the router, which threatens the confidentiality, integrity, and availability of network resources managed by the device.

Security patches available from the manufacturer should be applied according to the references. As immediate remedial measures, it is recommended to restrict access to the device's administrative panel exclusively to trusted IP addresses and avoid exposing the management interface to the public internet.

Wavlink WL-WN533A8 devices (Wavlink AC3000 M33A8) with firmware version V5030.210505