CVE-2024-34166 is a critical (CVSS 10.0) flaw in the Wavlink AC3000 router, firmware M33A8.V5030.210505. The touchlistsync function in touchlist_sync.cgi has an OS command injection weakness, and specially crafted HTTP requests can lead to arbitrary code execution. I could not confirm a fixed firmware version, so ask Wavlink, remove internet access to the admin interface, and replace the device if no fix exists.
What's affected
Per the NVD record, the affected product is the Wavlink AC3000 (WL-WN533A8) with firmware M33A8.V5030.210505. The record names no fixed version. It cites Cisco Talos report TALOS-2024-2000, which I could not retrieve, so I cannot state a patched release.
The weakness is in the touchlistsync function of the touchlist_sync.cgi handler. A separate CVE, CVE-2024-36258, affects the same handler as a stack overflow.
The CVSS vector is network based, needs no privileges or user interaction, and has a changed scope, which gives the top score of 10.0. The record does not mark the issue as exploited in the wild, and the KEV flag is false.
How to check if you're exposed
Find out whether you own or manage this router. Home office and branch sites often use consumer hardware that never appears in an IT asset list, so ask staff who work remotely.
On the device, open the web administration page from your local network and read the firmware version from the status or system page. M33A8.V5030.210505 is the affected build. You can also check the model number on the device label.
Next, check whether the admin interface is reachable from outside. From a network that is not the router's own, test the public address of the site on the web ports:
nc -vz PUBLIC-IP 80
nc -vz PUBLIC-IP 443
If either port answers, remote management is on or the device is exposed in another way.
What to do now
- Ask Wavlink for a firmware release that addresses CVE-2024-34166 and read its release notes.
- Turn off remote management and any port forwarding to the router's web interface.
- Put the router behind another firewall or segment where you can, so only trusted hosts reach its web interface.
- If no fixed firmware exists, replace the device with one from a vendor that still ships security updates.
- After any firmware change, set a new admin password and check DNS and port forwarding settings for entries you did not make.
- Keep the model and firmware in your asset list.
Why it matters
The class is CWE-77, command injection. A web handler on the router builds a command line from request data and passes it to the operating system shell. The crafted request carries extra shell syntax, and the router runs it as part of its own command.
Routers run these handlers with high rights, so code execution usually means full control of the device. An attacker in that position can watch traffic, change DNS settings or use the router as a base inside the network. Consumer routers rarely get logs or monitoring, so a compromise can last a long time without notice.
Quick check
What is the affected component?
The touchlistsync function in touchlist_sync.cgi, per the CVE description.
Sources
- Cisco Talos report TALOS-2024-2000 (listed in the CVE record, page could not be retrieved)
- NVD record for CVE-2024-34166
Last reviewed: 19 October 2026.
