Vulnerability · Published Jan 14, 2025 · Assigned by talos
CVE-2024-39754
Critical 10.0
In plain English
A critical-severity security flaw in Wavlink AC3000 from Wavlink. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)1.3%top 28.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wavlink | Wavlink AC3000 | M33A8.V5030.210505 |
Weakness: CWE-912 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H