CVE-2024-36493: wavlink wavlink ac3000 Stack-based Buffer Overflow

Vulnerability summary

CVE-2024-36493 is a critical (CVSS 9.1) Stack-based Buffer Overflow vulnerability in wavlink wavlink ac3000. EPSS estimates a 2.08% chance of exploitation in the next 30 days, higher than 81.3% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 14-01-2025
   PublishedVulnerability first disclosed.
2. 14-01-2025
   Last modifiedVulnerability information updated.

Description

A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).