CVE-2024-34166

The vulnerability exists in the CGI file 'touchlist_sync.cgi', specifically in the 'touchlistsync()' function. By sending a specially crafted HTTP request (or series of such requests), an attacker is able to inject malicious system commands into the call handled by this function. The lack of proper validation and sanitization of input data causes the supplied data to be interpreted and executed directly by the device's operating system.

An attacker can gain the ability to remotely execute arbitrary code without authentication (RCE) on the vulnerable device, which in practice means complete takeover of the router — including modification of network configuration, interception of network traffic, and use of the device as an entry point for further network penetration.

Patches available from the manufacturer should be applied according to the references. It is also recommended to restrict access to the device management interface exclusively to trusted hosts and to isolate the device from the public Internet until the update is deployed.

Wavlink AC3000, model WL-WN533A8, firmware version M33A8.V5030.210505