CVE-2024-36290 is a critical (CVSS 10.0) flaw in the Wavlink AC3000 router, firmware M33A8.V5030.210505. The Goto_chidx function in login.cgi has a buffer overflow, and an unauthenticated HTTP request can trigger a stack-based overflow. I could not confirm a fixed firmware version, so ask Wavlink, remove internet access to the admin interface, and replace the device if no fix exists.
What's affected
Per the NVD record, the affected product is the Wavlink AC3000 (WL-WN533A8) with firmware M33A8.V5030.210505. The record names no fixed version. It cites Cisco Talos report TALOS-2024-2019, which I could not retrieve, so I cannot state a patched release.
The weakness is in the Goto_chidx function of login.cgi. The advisory says an unauthenticated request can trigger it.
The CVSS vector is network based, needs no privileges or user interaction, and has a changed scope, which gives the top score of 10.0. The record does not mark the issue as exploited in the wild, and the KEV flag is false.
How to check if you're exposed
Find out whether you own or manage this router. Home office and branch sites often use consumer hardware that never appears in an IT asset list, so ask staff who work remotely.
On the device, open the web administration page from your local network and read the firmware version from the status or system page. M33A8.V5030.210505 is the affected build. You can also check the model number on the device label.
Next, check whether the admin interface is reachable from outside. From a network that is not the router's own, test the public address of the site on the web ports:
nc -vz PUBLIC-IP 80
nc -vz PUBLIC-IP 443
If either port answers, remote management is on or the device is exposed in another way.
What to do now
- Ask Wavlink for a firmware release that addresses CVE-2024-36290 and read its release notes.
- Turn off remote management and any port forwarding to the router's web interface.
- Put the router behind another firewall or segment where you can, so only trusted hosts reach its web interface.
- If no fixed firmware exists, replace the device with one from a vendor that still ships security updates.
- After any firmware change, set a new admin password and check DNS and port forwarding settings for entries you did not make.
- Keep the model and firmware in your asset list.
Why it matters
The class is CWE-120, a classic buffer overflow. The code copies input into a buffer without checking that it fits. The vulnerable handler is the login page, which anyone who can reach the router can call, so no account is needed.
A flaw on the login handler is among the worst places for this bug, because authentication has not happened yet. The only reliable fix is new firmware. Without one, the router should not be reachable from untrusted networks, and the device should be on a replacement plan.
Quick check
Does the attacker need a password?
No. The description says an unauthenticated HTTP request can trigger the overflow in login.cgi.
Sources
- Cisco Talos report TALOS-2024-2019 (listed in the CVE record, page could not be retrieved)
- NVD record for CVE-2024-36290
Last reviewed: 19 October 2026.
