Description

CVE-2024-39785 describes multiple command execution vulnerabilities present in the nas.cgi add_dir() functionality of the Wavlink AC3000 M33A8.V5030.210505 router. These vulnerabilities allow an attacker to execute arbitrary commands on the affected device by sending a specially crafted HTTP request. The vulnerability is triggered by a command injection vulnerability in the adddir_name POST parameter. While the CVSS score is high at 9.1, the SOCRadar Vulnerability Risk Score (SVRS) is 42, indicating a moderate vulnerability requiring attention.

Key Insights

• Remote Code Execution: The vulnerabilities allow an attacker to remotely execute commands on the affected device, potentially gaining full control over the system.
• Authenticated Attack: Although authentication is required, this doesn't necessarily prevent exploitation. An attacker with legitimate credentials or who has compromised a user account can exploit these vulnerabilities.
• Widely Used Device: The affected router is a popular model, increasing the potential impact of this vulnerability.
• Active Exploitation: The "In The Wild" tag indicates that attackers are actively exploiting these vulnerabilities.

Mitigation Strategies

• Firmware Update: Update the firmware on the affected router to the latest version, which will patch these vulnerabilities.
• Network Segmentation: Isolate the router from other sensitive devices on the network to limit the impact of a successful attack.
• Strong Passwords: Implement strong and unique passwords for the router and all connected accounts.
• Multi-Factor Authentication (MFA): Enable MFA for all router and connected accounts to enhance security.

Additional Information

If users have additional queries regarding this incident, they can use the "Ask to Analyst" feature, contact SOCRadar directly, or open a support ticket for more information if necessary.