CVE-2024-39608 is a critical (CVSS 10.0) flaw in the Wavlink AC3000 router, firmware M33A8.V5030.210505. A firmware update function in login.cgi can be reached by an unauthenticated message, and a crafted HTTP request can lead to an arbitrary firmware update. I could not confirm a fixed firmware version, so ask Wavlink, remove internet access to the admin interface, and replace the device if no fix exists.
What's affected
Per the NVD record, the affected product is the Wavlink AC3000 (WL-WN533A8) with firmware M33A8.V5030.210505. The record names no fixed version. It cites Cisco Talos report TALOS-2024-2036, which I could not retrieve, so I cannot state a patched release.
The weakness is in the login.cgi firmware update functionality, which a crafted unauthenticated message can reach.
The CVSS vector is network based, needs no privileges or user interaction, and has a changed scope, which gives the top score of 10.0. The record does not mark the issue as exploited in the wild, and the KEV flag is false.
How to check if you're exposed
Find out whether you own or manage this router. Home office and branch sites often use consumer hardware that never appears in an IT asset list, so ask staff who work remotely.
On the device, open the web administration page from your local network and read the firmware version from the status or system page. M33A8.V5030.210505 is the affected build. You can also check the model number on the device label.
Next, check whether the admin interface is reachable from outside. From a network that is not the router's own, test the public address of the site on the web ports:
nc -vz PUBLIC-IP 80
nc -vz PUBLIC-IP 443
If either port answers, remote management is on or the device is exposed in another way.
What to do now
- Ask Wavlink for a firmware release that addresses CVE-2024-39608 and read its release notes.
- Turn off remote management and any port forwarding to the router's web interface.
- Put the router behind another firewall or segment where you can, so only trusted hosts reach its web interface.
- If no fixed firmware exists, replace the device with one from a vendor that still ships security updates.
- After any firmware change, set a new admin password and check DNS and port forwarding settings for entries you did not make.
- Keep the model and firmware in your asset list.
- If you suspect the firmware was replaced, reflash known good firmware from the vendor and rotate credentials that passed through the router, or replace the device.
Why it matters
The class is CWE-306, missing authentication for a critical function. Replacing firmware is the most powerful action on a device, and it should need a logged-in administrator. Here a crafted request reaches that function without one.
An attacker who can install their own firmware owns the device in a way that survives reboots and resets of settings. That makes this flaw worth treating as a total compromise, and it explains the top score. Recovery means reflashing known good firmware from the vendor, if the vendor provides one, and changing every credential that passed through the router.
Quick check
Why is a firmware update flaw so serious?
Firmware controls everything on the device. Replacing it gives an attacker persistent control that settings resets do not remove.
Sources
- Cisco Talos report TALOS-2024-2036 (listed in the CVE record, page could not be retrieved)
- NVD record for CVE-2024-39608
Last reviewed: 19 October 2026.
