CVE-2024-48705 describes a post-authentication command injection vulnerability in Wavlink AC1200 devices, specifically firmware versions M32A3_V1410_230602 and M32A3_V1410_240222, affecting models like the WL-WN531P3. This medium-severity flaw (CVSS 6.5) stems from improper sanitization of the "newpass" field within the "set_sys_adm" function during password resets, allowing an authenticated attacker to execute arbitrary commands. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential future interest.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
m32a3_v1410_230602CPE matchmatch criteria | cpe:2.3:o:wavlink:wl-wn531p3_firmware:m32a3_v1410_230602:*:*:*:*:*:*:* | ||
m32a3_v1410_240222CPE matchmatch criteria | cpe:2.3:o:wavlink:wl-wn531p3_firmware:m32a3_v1410_240222:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.