Wavlink AC3000 vulnerabilities

60 known vulnerabilities in Wavlink AC3000 from WAVLINK. 60 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39803Jan 14, 2025WAVLINKEPSS 1.29%

  Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to tri

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39802Jan 14, 2025WAVLINK

  Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to tri

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39801Jan 14, 2025WAVLINKEPSS 1.38%

  Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to tri

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39800Jan 14, 2025WAVLINKEPSS 1.92%

  Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticate

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39799Jan 14, 2025WAVLINKEPSS 1.34%

  Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticate

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39798Jan 14, 2025WAVLINKEPSS 1.92%

  Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticate

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39795Jan 14, 2025WAVLINKEPSS 1.56%

  Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to tr

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39794Jan 14, 2025WAVLINKEPSS 1.1%

  Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to tr

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39793Jan 14, 2025WAVLINKEPSS 1.56%

  Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to tr

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39790Jan 14, 2025WAVLINKEPSS 1.56%

  Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigge

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39789Jan 14, 2025WAVLINKEPSS 1.1%

  Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigge

• 7.2 High severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39788Jan 14, 2025WAVLINKEPSS 1.56%

  Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigge

• 7.2 High severity

  Wavlink AC3000: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-39787Jan 14, 2025WAVLINKEPSS 2.59%

  Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these

• 7.2 High severity

  Wavlink AC3000: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2024-39786Jan 14, 2025WAVLINKEPSS 2.59%

  Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2024-39785Jan 14, 2025WAVLINKEPSS 6.37%

  Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigge

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2024-39784Jan 14, 2025WAVLINKEPSS 6.37%

  Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigge

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39783Jan 14, 2025WAVLINKEPSS 4.6%

  Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to t

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39782Jan 14, 2025WAVLINKEPSS 3.82%

  Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to t

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39781Jan 14, 2025WAVLINKEPSS 4.6%

  Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to t

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39774Jan 14, 2025WAVLINKEPSS 1.35%

  A buffer overflow vulnerability exists in the adm.cgi set_sys_adm() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39770Jan 14, 2025WAVLINKEPSS 1.29%

  Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to tri

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39769Jan 14, 2025WAVLINK

  Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to tri

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39768Jan 14, 2025WAVLINKEPSS 1.29%

  Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to tri

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39765Jan 14, 2025WAVLINKEPSS 5.36%

  Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP r

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39764Jan 14, 2025WAVLINKEPSS 4.28%

  Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP r

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39763Jan 14, 2025WAVLINKEPSS 4.95%

  Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP r

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39762Jan 14, 2025WAVLINKEPSS 6.04%

  Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP r

• 9.8 Critical severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39761Jan 14, 2025WAVLINKEPSS 8.4%

  Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request

• 9.8 Critical severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39760Jan 14, 2025WAVLINKEPSS 17.8%

  Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request

• 9.8 Critical severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39759Jan 14, 2025WAVLINKEPSS 8.4%

  Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request

• 7.2 High severity

  Wavlink AC3000: Stack-based Buffer Overflow

  CVE-2024-39757Jan 14, 2025WAVLINKEPSS 2.47%

  A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39756Jan 14, 2025WAVLINKEPSS 1.93%

  A buffer overflow vulnerability exists in the adm.cgi rep_as_router() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger th

• 9.8 Critical severity

  Wavlink AC3000: Hidden Functionality

  CVE-2024-39754Jan 14, 2025WAVLINKEPSS 1.34%

  A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability.

• 9.8 Critical severity

  Wavlink AC3000: Missing Authentication for Critical Functionality

  CVE-2024-39608Jan 14, 2025WAVLINKEPSS 1.46%

  A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can send an unauthenticated message to trigger this vulnerability.

• 8.1 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2024-39604Jan 14, 2025WAVLINKEPSS 1.99%

  A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can perform a man-in-the-middle attack to trigger thi

• 7.2 High severity

  Wavlink AC3000: Stack-based Buffer Overflow

  CVE-2024-39603Jan 14, 2025WAVLINKEPSS 2.47%

  A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTT

• 9.1 Critical severity

  Wavlink AC3000: External Control of System or Configuration Setting

  CVE-2024-39602Jan 14, 2025WAVLINKEPSS 2.38%

  An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger

• 7.2 High severity

  Wavlink AC3000: Buffer Copy without Checking Size of Input

  CVE-2024-39370Jan 14, 2025WAVLINKEPSS 2.24%

  An arbitrary code execution vulnerability exists in the adm.cgi set_MeshAp() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigge

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39367Jan 14, 2025WAVLINKEPSS 8.48%

  An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP reque

• 7.2 High severity

  Wavlink AC3000: Improper Neutralization of Special Elements used in a Command

  CVE-2024-39360Jan 14, 2025WAVLINKEPSS 12%

  An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger th