CVE-2024-36258 is a critical (CVSS 10.0) flaw in the Wavlink AC3000 router, firmware M33A8.V5030.210505. The touchlistsync function in touchlist_sync.cgi has a stack-based buffer overflow, and a specially crafted HTTP request can lead to arbitrary code execution. I could not confirm a fixed firmware version, so ask Wavlink, remove internet access to the admin interface, and replace the device if no fix exists.
What's affected
Per the NVD record, the affected product is the Wavlink AC3000 (WL-WN533A8) with firmware M33A8.V5030.210505. The record names no fixed version. It cites Cisco Talos report TALOS-2024-2046, which I could not retrieve, so I cannot state a patched release.
The weakness is in the same touchlist_sync.cgi handler as the command injection CVE-2024-34166, but it is a separate memory safety flaw.
The CVSS vector is network based, needs no privileges or user interaction, and has a changed scope, which gives the top score of 10.0. The record does not mark the issue as exploited in the wild, and the KEV flag is false.
How to check if you're exposed
Find out whether you own or manage this router. Home office and branch sites often use consumer hardware that never appears in an IT asset list, so ask staff who work remotely.
On the device, open the web administration page from your local network and read the firmware version from the status or system page. M33A8.V5030.210505 is the affected build. You can also check the model number on the device label.
Next, check whether the admin interface is reachable from outside. From a network that is not the router's own, test the public address of the site on the web ports:
nc -vz PUBLIC-IP 80
nc -vz PUBLIC-IP 443
If either port answers, remote management is on or the device is exposed in another way.
What to do now
- Ask Wavlink for a firmware release that addresses CVE-2024-36258 and read its release notes.
- Turn off remote management and any port forwarding to the router's web interface.
- Put the router behind another firewall or segment where you can, so only trusted hosts reach its web interface.
- If no fixed firmware exists, replace the device with one from a vendor that still ships security updates.
- After any firmware change, set a new admin password and check DNS and port forwarding settings for entries you did not make.
- Keep the model and firmware in your asset list.
Why it matters
The class is CWE-121, stack-based buffer overflow. The handler copies data from the request into a fixed-size buffer on the stack without checking its length. A request that is too long overwrites nearby memory, which can crash the process or let an attacker steer it.
Embedded devices often lack the memory protections that desktop systems have, so overflows tend to be more dependable to exploit there. The fix is a length check in the code, which only the vendor can ship. Until then, keeping the web interface away from untrusted networks is the control you have.
Quick check
How is this different from CVE-2024-34166?
Both are in touchlist_sync.cgi. One is a command injection and the other is a stack overflow, so they have separate root causes in the same handler.
Sources
- Cisco Talos report TALOS-2024-2046 (listed in the CVE record, page could not be retrieved)
- NVD record for CVE-2024-36258
Last reviewed: 19 October 2026.
