CVE-2024-36258: wavlink wavlink ac3000 Stack-based Buffer Overflow

Vulnerability summary

CVE-2024-36258 is a critical (CVSS 10.0) Stack-based Buffer Overflow vulnerability in wavlink wavlink ac3000. EPSS estimates a 12.79% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 14-01-2025
   PublishedVulnerability first disclosed.
2. 14-01-2025
   Last modifiedVulnerability information updated.

Description

A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).