Description

CVE-2024-39800 is a critical vulnerability affecting the Wavlink AC3000 M33A8.V5030.210505 router. It involves multiple external configuration control vulnerabilities within the openvpn.cgi openvpn_server_setup() functionality. Exploiting these vulnerabilities allows attackers to execute arbitrary commands on the affected device through specially crafted HTTP requests. This vulnerability is particularly concerning as it leverages a configuration injection vulnerability in the open_port POST parameter, making it relatively easy for attackers to exploit.

While the CVSS score is high at 9.1, the SOCRadar Vulnerability Risk Score (SVRS) is 42, indicating a moderate risk level. However, the fact that this vulnerability is "In The Wild" emphasizes the urgency of addressing it.

Key Insights

• Remote Code Execution: This vulnerability allows attackers to execute arbitrary commands on the affected device, giving them complete control over the router.
• Configuration Injection: The vulnerability leverages a configuration injection flaw in the open_port parameter, enabling attackers to manipulate the device's configuration settings.
• Authentication Bypass: While the CVE description mentions an authenticated request, the exploitability of this vulnerability may allow attackers to bypass authentication mechanisms, potentially making it easier to exploit.
• Active Exploitation: The CVE-2024-39800 vulnerability is being actively exploited by hackers in the wild, meaning immediate action is crucial.

Mitigation Strategies

• Firmware Update: The highest priority is to update the Wavlink AC3000 M33A8.V5030.210505 router to the latest firmware version. This patch should address the vulnerability.
• Network Segmentation: Isolate the router from critical networks by implementing network segmentation. This restricts the impact of a successful exploit and limits the attacker's ability to move laterally within your network.
• Security Auditing: Conduct regular security audits to identify and mitigate potential vulnerabilities within your network, including router configurations.
• Intrusion Detection Systems (IDS): Deploy IDS solutions to detect malicious network traffic patterns that might indicate exploitation attempts targeting this vulnerability.

Additional Information

If you have additional queries regarding this incident, you can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.