CVE-2024-39759 is a critical (CVSS 10.0) flaw in the Wavlink AC3000 router, firmware M33A8.V5030.210505. Multiple OS command injection weaknesses exist in the set_sys_init function of login.cgi, and this one is in the restart_hour_value POST parameter. An unauthenticated HTTP request can lead to arbitrary code execution. I could not confirm a fixed firmware version, so ask Wavlink, remove internet access to the admin interface, and replace the device if no fix exists.
What's affected
Per the NVD record, the affected product is the Wavlink AC3000 (WL-WN533A8) with firmware M33A8.V5030.210505. The record names no fixed version. It cites Cisco Talos report TALOS-2024-2018, which I could not retrieve, so I cannot state a patched release.
The weakness is in the restart_hour_value POST parameter of the set_sys_init function in login.cgi. The same Talos report covers CVE-2024-39760, CVE-2024-39761, which are the sibling parameters of the same function.
The CVSS vector is network based, needs no privileges or user interaction, and has a changed scope, which gives the top score of 10.0. The record does not mark the issue as exploited in the wild, and the KEV flag is false.
How to check if you're exposed
Find out whether you own or manage this router. Home office and branch sites often use consumer hardware that never appears in an IT asset list, so ask staff who work remotely.
On the device, open the web administration page from your local network and read the firmware version from the status or system page. M33A8.V5030.210505 is the affected build. You can also check the model number on the device label.
Next, check whether the admin interface is reachable from outside. From a network that is not the router's own, test the public address of the site on the web ports:
nc -vz PUBLIC-IP 80
nc -vz PUBLIC-IP 443
If either port answers, remote management is on or the device is exposed in another way.
What to do now
- Ask Wavlink for a firmware release that addresses CVE-2024-39759 and read its release notes.
- Turn off remote management and any port forwarding to the router's web interface.
- Put the router behind another firewall or segment where you can, so only trusted hosts reach its web interface.
- If no fixed firmware exists, replace the device with one from a vendor that still ships security updates.
- After any firmware change, set a new admin password and check DNS and port forwarding settings for entries you did not make.
- Keep the model and firmware in your asset list.
Why it matters
The class is CWE-77, command injection. The set_sys_init handler takes scheduled restart settings from a form and builds a command with them. The restart_hour_value field is one of three such inputs, and none of them are checked, so extra shell syntax in the field reaches the shell.
Talos grouped the three fields in one report. Fixing one parameter and missing another is a common outcome, so a vendor patch should be tested against all three of CVE-2024-39759, CVE-2024-39760, CVE-2024-39761. The handler is on the login page, so the attacker does not need an account.
Quick check
Why are there three CVEs for one handler?
Each CVE covers a different POST parameter in login.cgi set_sys_init, so each needs its own fix and its own test.
Sources
- Cisco Talos report TALOS-2024-2018 (listed in the CVE record, page could not be retrieved)
- NVD record for CVE-2024-39759
Last reviewed: 19 October 2026.
