CVE-2024-39787
CVE-2024-39787 affects Wavlink AC3000 routers, allowing attackers to bypass permissions via directory traversal. Multiple directory traversal vulnerabilities are present in the nas.cgi add_dir() function, specifically via the disk_part POST parameter. An authenticated attacker can exploit these flaws by sending a specially crafted HTTP request. Although the CVSS score is high at 9.1, the SOCRadar Vulnerability Risk Score (SVRS) is 42, suggesting a lower real-world risk compared to the CVSS score alone. This permission bypass could enable unauthorized access to sensitive files and system resources. While the SVRS indicates it's not a critical vulnerability requiring immediate action, monitoring and patching are still recommended to mitigate potential risks on Wavlink AC3000 devices. The presence of the "In The Wild" tag suggests that exploits have been observed.
Description
CVE-2024-39787 is a critical directory traversal vulnerability affecting the Wavlink AC3000 M33A8.V5030.210505 model. This vulnerability stems from a flaw in the nas.cgi component's add_dir() functionality, where specially crafted HTTP requests can bypass permission checks. The vulnerability specifically lies within the disk_part POST parameter. While the CVSS score is 9.1, indicating a high severity, the SOCRadar Vulnerability Risk Score (SVRS) is 42, which suggests a moderate risk level.
Key Insights
- Exploitation: The vulnerability is actively exploited "In The Wild," indicating that threat actors are using it to gain unauthorized access to systems.
- Impact: Successful exploitation of this vulnerability could allow attackers to read, write, and execute arbitrary files on the affected device, potentially leading to data exfiltration, system compromise, and even complete control over the device.
- Attack Vectors: The vulnerability can be exploited via specially crafted HTTP requests. This makes it accessible remotely, potentially enabling attackers to compromise devices without physical access.
- Affected Systems: This vulnerability specifically targets the Wavlink AC3000 M33A8.V5030.210505 model. Users and organizations employing this device should prioritize patching and mitigation measures.
Mitigation Strategies
- Patching: Immediately apply the latest security updates and patches released by Wavlink for the affected device. These patches should address the vulnerability and mitigate the risks.
- Network Segmentation: Implement network segmentation to isolate the affected device from other sensitive systems, limiting the impact of a successful attack.
- Input Validation: Ensure proper input validation and sanitization for HTTP requests and POST parameters to prevent the injection of malicious data that could trigger the vulnerability.
- Intrusion Detection and Prevention Systems (IDS/IPS): Deploy and configure IDS/IPS systems to detect and block malicious traffic targeting this vulnerability.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.