CVE-2024-39798

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the `sel_open_protocol` POST parameter.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-15

Affected software

No affected versions have been published.

Timeline

Published: Jan 14, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-397997.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503 CVE-2024-39808.8The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesyst CVE-2024-398007.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503 CVE-2024-398017.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398027.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398037.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398049.1A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can leverage PowerPoint's acce CVE-2024-398057.8Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authenticated user to poten CVE-2024-398065.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.CVE-2024-398075.3Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to properly sanitize the recipients of a webhook event which allows an attacker monitoring CVE-2024-398084.6Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP message handling, allows an attacker with phy CVE-2024-398098.8The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Tech