CVE-2024-39765

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability exists in the `custom_interface` POST parameter.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Jan 14, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-397667.0Improper neutralization of special elements used in SQL command in some Intel(R) Neural Compressor software before version v3.0 may allow an CVE-2024-397676.5Mattermost Mobile Apps versions <=2.16.0 fail to validate that the push notifications received for a server actually came from this serve th CVE-2024-397687.2Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-397697.2Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-39774.8The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privile CVE-2024-397707.2Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-397716.8QBiC CLOUD CC-2L v1.1.30 and earlier and Safie One v1.8.2 and earlier do not properly validate certificates, which may allow a network-adjac CVE-2024-397725.3Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-qua CVE-2024-397735.3An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HT CVE-2024-397747.2A buffer overflow vulnerability exists in the adm.cgi set_sys_adm() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted CVE-2024-397757.5in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read.CVE-2024-397767.5Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.