A buffer overflow vulnerability exists in the login.cgi Goto_chidx() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
The vulnerability (CWE-120) results from the lack of proper validation of input data length in the Goto_chidx() function handled by the login.cgi script. The attacker sends a specially crafted HTTP request, which causes a stack-based buffer overflow. Since the vulnerability is available without authentication and the attack vector is network-based and does not require any user interaction or special privileges, it can be exploited remotely by anyone who has access to the device's interface.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code (RCE) remotely on the device with full privileges, as well as lead to complete takeover of the router and loss of confidentiality, integrity, and availability of supported resources.
Patches available from the manufacturer should be applied in accordance with the references. Until an update is applied, it is recommended to restrict access to the device's administrative panel only to trusted IP addresses and to disable exposure of the management interface to the public network (Internet).
Wavlink AC3000 (model WL-WN533A8), firmware version M33A8.V5030.210505
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HWavlink Wl Wn533a8
HWWavlinkwszystkie wersjeWavlink Wl Wn533a8 Firmware
OSWavlinkm33a8.v5030.210505
Related vulnerabilities
Command injection w Wavlink AC3000 — wykonanie dowolnych poleceń przez adm.cgi
Command injection w firmware Wavlink AC3000 — zdalne wykonanie kodu
Command injection w Wavlink AC3000 – nieautoryzowane wykonanie poleceń
Stack-based buffer overflow w Wavlink AC3000 umożliwia RCE przez HTTP
Buffer overflow w Wavlink AC3000 — podatność w funkcji set_info() usbip.cgi