9.1
CVE-2024-37186
- EPSS 22.83%
- Veröffentlicht 14.01.2025 15:15:17
- Zuletzt bearbeitet 21.08.2025 20:38:56
- Quelle talos-cna@cisco.com
- CVE-Watchlists
- Unerledigt
LoginAn os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wavlink ≫ Wl-wn533a8 Firmware Versionm33a8.v5030.210505
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 22.83% | 0.974 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| talos-cna@cisco.com | 9.1 | 2.3 | 6 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
|
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
https://talosintelligence.com/vulnerability_reports/TALOS-2024-2032
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2032