CVE-2024-48705: wavlink wl-wn531p3_firmware Command Injection

Vulnerability summary

CVE-2024-48705 is a medium (CVSS 6.5) Command Injection vulnerability in wavlink wl-wn531p3_firmware. EPSS estimates a 3.35% chance of exploitation in the next 30 days, higher than 88.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-09-2025
   PublishedVulnerability first disclosed.
2. 05-07-2026
   Last modifiedVulnerability information updated.

Description

Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the password. This vulnerability is specifically found within the "set_sys_adm" function of the "adm.cgi" binary, and is due to improper santization of the user provided "newpass" field

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.