CVE-2024-37357

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Jan 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-373587.5Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and CVE-2024-373598.6The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficie CVE-2024-37367.5A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the func CVE-2024-373604.4Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2024-373619.9The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi CVE-2024-373626.3The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception CVE-2024-373636.5The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitac CVE-2024-373646.8Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensi CVE-2024-373657.8A remote code execution vulnerability exists in the affected product. The vulnerability allows users to save projects within the public dire CVE-2024-373677.5A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE v12. The vulnerability allows a user from a remot CVE-2024-373687.5A user authentication vulnerability exists in the Rockwell Automation FactoryTalk® View SE. The vulnerability allows a user from a remote sy CVE-2024-373698.8A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing