CVE-2024-39800

The vulnerability consists of insufficient validation of the POST parameter named `open_port`, passed to the openvpn_server_setup() function in the openvpn.cgi script. An attacker who has access to an authenticated HTTP session can craft a specially prepared HTTP request containing malicious values in this parameter. The injected data is then processed as part of the configuration in a way that allows arbitrary system commands to be executed (command injection through the configuration injection mechanism).

An authenticated attacker can execute arbitrary system commands on the vulnerable device, which in practice means the possibility of complete takeover of the router, violation of data confidentiality and integrity, and disruption of network service availability.

Patches available from the manufacturer should be applied in accordance with the references. Additionally, it is recommended to restrict access to the device management interface only to trusted IP addresses and avoid exposing the admin panel to public access over the Internet.

Wavlink AC3000 routers (WL-WN533A8 models) with firmware version M33A8.V5030.210505