CVE-2024-39802

Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the `qos_dat` POST parameter.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2049	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:wavlink:wl-wn533a8_firmware:m33a8.v5030.210505:*:*:*:*:*:*:*

cpe:2.3:h:wavlink:wl-wn533a8:-:*:*:*:*:*:*:*

History

21 Aug 2025, 20:49

Type	Values Removed	Values Added
First Time		Wavlink wl-wn533a8 Firmware Wavlink wl-wn533a8 Wavlink
References	~~() https://talosintelligence.com/vulnerability_reports/TALOS-2024-2049 -~~	() https://talosintelligence.com/vulnerability_reports/TALOS-2024-2049 - Exploit, Third Party Advisory
CPE		cpe:2.3:h:wavlink:wl-wn533a8:-:::::::* cpe:2.3:o:wavlink:wl-wn533a8_firmware:m33a8.v5030.210505:::::::*
Summary		(es) Existen múltiples vulnerabilidades de desbordamiento de búfer en la función qos_settings() de qos.cgi de Wavlink AC3000 M33A8.V5030.210505. Una solicitud HTTP manipulada especialmente puede provocar un desbordamiento de búfer basado en la pila. Un atacante puede realizar una solicitud HTTP autenticada para activar estas vulnerabilidades. Existe una vulnerabilidad de desbordamiento de búfer en el parámetro POST `qos_dat`.

14 Jan 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-14 15:15

Updated : 2025-08-21 20:49

NVD link : CVE-2024-39802

Mitre link : CVE-2024-39802

CVE.ORG link : CVE-2024-39802

JSON object : View

Products Affected

wavlink

wl-wn533a8
wl-wn533a8_firmware

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2024-39802", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2025-01-14T15:15:25.677", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2049", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability exists in the `qos_dat` POST parameter."}, {"lang": "es", "value": "Existen m\u00faltiples vulnerabilidades de desbordamiento de b\u00fafer en la funci\u00f3n qos_settings() de qos.cgi de Wavlink AC3000 M33A8.V5030.210505. Una solicitud HTTP manipulada especialmente puede provocar un desbordamiento de b\u00fafer basado en la pila. Un atacante puede realizar una solicitud HTTP autenticada para activar estas vulnerabilidades. Existe una vulnerabilidad de desbordamiento de b\u00fafer en el par\u00e1metro POST `qos_dat`."}], "lastModified": "2025-08-21T20:49:45.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:wavlink:wl-wn533a8_firmware:m33a8.v5030.210505:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC5E3005-3FAD-449B-A34F-AAD42FB82614"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:wavlink:wl-wn533a8:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2536B2FD-9821-4A7C-9D42-D8E05A5CE330"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "talos-cna@cisco.com"}