CVE-2024-39754 is a critical (CVSS 10.0) flaw in the Wavlink AC3000 router, firmware M33A8.V5030.210505. A static login in the wctrls functionality means specially crafted network packets can lead to root access. I could not confirm a fixed firmware version, so ask Wavlink, remove internet access to the admin interface, and replace the device if no fix exists.
What's affected
Per the NVD record, the affected product is the Wavlink AC3000 (WL-WN533A8) with firmware M33A8.V5030.210505. The record names no fixed version. It cites Cisco Talos report TALOS-2024-2034, which I could not retrieve, so I cannot state a patched release.
The weakness is a static login in the wctrls functionality, reachable with specially crafted network packets rather than through the web page.
The CVSS vector is network based, needs no privileges or user interaction, and has a changed scope, which gives the top score of 10.0. The record does not mark the issue as exploited in the wild, and the KEV flag is false.
How to check if you're exposed
Find out whether you own or manage this router. Home office and branch sites often use consumer hardware that never appears in an IT asset list, so ask staff who work remotely.
On the device, open the web administration page from your local network and read the firmware version from the status or system page. M33A8.V5030.210505 is the affected build. You can also check the model number on the device label.
Next, check whether the admin interface is reachable from outside. From a network that is not the router's own, test the public address of the site on the web ports:
nc -vz PUBLIC-IP 80
nc -vz PUBLIC-IP 443
If either port answers, remote management is on or the device is exposed in another way.
What to do now
- Ask Wavlink for a firmware release that addresses CVE-2024-39754 and read its release notes.
- Turn off remote management and any port forwarding to the router's web interface.
- Put the router behind another firewall or segment where you can, so only trusted hosts reach its web interface.
- If no fixed firmware exists, replace the device with one from a vendor that still ships security updates.
- After any firmware change, set a new admin password and check DNS and port forwarding settings for entries you did not make.
- Keep the model and firmware in your asset list.
- Block inbound traffic to the router from untrusted networks at an upstream firewall.
Why it matters
The record lists CWE-912, hidden functionality. The wctrls service accepts a fixed login that the owner does not know about and cannot change. Packets that use it lead to root access on the router.
Hidden access paths of this kind are often left over from factory testing or support tooling. They are the same on every unit of a model, so one discovery applies to all of them. You cannot defend such a device by choosing a strong password, since the hidden login ignores it. Network isolation and replacement are the options.
Quick check
Can I stop this with a strong admin password?
No. The flaw is a static login that does not depend on the password you set, so isolation or replacement is the answer.
Sources
- Cisco Talos report TALOS-2024-2034 (listed in the CVE record, page could not be retrieved)
- NVD record for CVE-2024-39754
Last reviewed: 19 October 2026.
