CVE-2024-39791

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow vulnerabilities affecting Vonets

industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an unauthenticated remote attacker to execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

VendorProductVersions
VonetsVAR1200-H<= 3.3.23.6.9
VonetsVAR1200-L<= 3.3.23.6.9
VonetsVAR600-H<= 3.3.23.6.9
VonetsVAP11AC<= 3.3.23.6.9
VonetsVAP11G-500S<= 3.3.23.6.9
VonetsVBG1200<= 3.3.23.6.9
VonetsVAP11S-5G<= 3.3.23.6.9
VonetsVAP11S<= 3.3.23.6.9
VonetsVAR11N-300<= 3.3.23.6.9
VonetsVAP11G-300<= 3.3.23.6.9
VonetsVAP11N-300<= 3.3.23.6.9
VonetsVAP11G<= 3.3.23.6.9
VonetsVAP11G-500<= 3.3.23.6.9
VonetsVBG1200<= 3.3.23.6.9
VonetsVAP11AC<= 3.3.23.6.9
VonetsVGA-1000<= 3.3.23.6.9
vonetsvar1200-h_firmware<= 3.3.23.6.9
vonetsvar1200-l_firmware<= 3.3.23.6.9
vonetsvar600-h_firmware<= 3.3.23.6.9
vonetsvap11ac_firmware<= 3.3.23.6.9
vonetsvap11g-500s_firmware<= 3.3.23.6.9
vonetsvbg1200_firmware<= 3.3.23.6.9
vonetsvap11s-5g_firmware<= 3.3.23.6.9
vonetsvap11s_firmware<= 3.3.23.6.9
vonetsvar11n-300_firmware<= 3.3.23.6.9
vonetsvap11n-300_firmware<= 3.3.23.6.9
vonetsvap11g_firmware<= 3.3.23.6.9
vonetsvga-1000_firmware<= 3.3.23.6.9
vonetsvap11g-300_firmware<= 3.3.23.6.9
vonetsvap11n-300_firmware<= 3.3.23.6.9

References

Timeline

Published
Aug 12, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-397927.5When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilizationCVE-2024-397937.2Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. CVE-2024-397947.2Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. CVE-2024-397957.2Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. CVE-2024-397976.5Improper access control in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may allow an authenticated usCVE-2024-397987.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503CVE-2024-397997.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503CVE-2024-39808.8The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystCVE-2024-398007.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503CVE-2024-398017.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A speciallyCVE-2024-398027.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A speciallyCVE-2024-398037.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially
CVE-2024-39791: Critical severity, CVSS 9.8 | Vulnix