A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability.
Static login credentials are hardcoded in the wctrls functionality of the Wavlink AC3000 M33A8 device and cannot be changed by the user. By sending specially crafted network packets to the vulnerable device, an attacker can use these credentials to authenticate without knowing any credentials. As a result, the attacker gains root-level access without requiring any user interaction.
Attacker gains full, unauthenticated root access to the device, meaning complete control — ability to read and modify configuration, intercept network traffic, and further use the device as an entry point to the network.
Apply patches available from the manufacturer according to references. It is recommended to restrict network access to the device management panel (firewall-level filtering, VLAN isolation) until the update is deployed.
Wavlink AC3000 M33A8, firmware version V5030.210505 (products: Wavlink Wl-Wn533A8 / Wl-Wn533A8 Firmware)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HWavlink Wl Wn533a8
HWWavlinkwszystkie wersjeWavlink Wl Wn533a8 Firmware
OSWavlinkm33a8.v5030.210505
Related vulnerabilities
Command injection w Wavlink AC3000 — wykonanie dowolnych poleceń przez adm.cgi
Command injection w firmware Wavlink AC3000 — zdalne wykonanie kodu
Command injection w Wavlink AC3000 – nieautoryzowane wykonanie poleceń
Stack-based buffer overflow w Wavlink AC3000 umożliwia RCE przez HTTP
Buffer overflow w Wavlink AC3000 — podatność w funkcji set_info() usbip.cgi