CVE-2024-39761
CVSS 3.1 Score 10 of 10 (high)
Details
Published Jan 14, 2025
CWE ID 77
Summary
CVE-2024-39761 refers to multiple OS command injection vulnerabilities discovered in the set_sys_init() functionality of Wavlink AC3000 M33A8's login.cgi. A maliciously crafted HTTP request can exploit these vulnerabilities, allowing an attacker to execute arbitrary code unauthenticated. The vulnerability specifically resides within the `restart_week_value` POST parameter. This issue poses a significant risk and requires immediate attention and patching to prevent potential unauthorized system access and manipulation.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.