wl-wn533a8 firmware vulnerabilities and fixes

Recent CVEs affecting wl-wn533a8 firmware, with upgrade or downgrade steps. 62 tracked.

Also searched as: wl wn533a8 firmware, wl-wn533a8firmware.

wl-wn533a8 firmware has 62 tracked vulnerabilities, 61 critical. A fixed release or vendor patch exists for 5. Most recent: 2025-01-14. Highest priority: CVE-2024-39761 (score 72/100).

• CVE-2024-39803 CRITICAL 9.1 MITIGATE Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M
• CVE-2024-39802 CRITICAL 9.1 MITIGATE Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M
• CVE-2024-39801 CRITICAL 9.1 MITIGATE Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M
• CVE-2024-39800 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionalit
• CVE-2024-39799 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionalit
• CVE-2024-39798 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionalit
• CVE-2024-39795 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavli
• CVE-2024-39794 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavli
• CVE-2024-39793 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavli
• CVE-2024-39790 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink A
• CVE-2024-39789 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink A
• CVE-2024-39788 CRITICAL 9.1 MITIGATE Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink A
• CVE-2024-39787 CRITICAL 9.1 MITIGATE Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M3
• CVE-2024-39786 CRITICAL 9.1 MITIGATE Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M3
• CVE-2024-39785 CRITICAL 9.1 MITIGATE Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A
• CVE-2024-39784 CRITICAL 9.1 MITIGATE Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A
• CVE-2024-39783 CRITICAL 9.1 MITIGATE Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC300
• CVE-2024-39782 CRITICAL 9.1 MITIGATE Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC300
• CVE-2024-39781 CRITICAL 9.1 MITIGATE Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC300
• CVE-2024-39774 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the adm.cgi set_sys_adm() functionality of Wavlink AC3000 M33A8.V503
• CVE-2024-39773 MEDIUM 5.3 MITIGATE An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.
• CVE-2024-39770 CRITICAL 9.1 MITIGATE Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M
• CVE-2024-39769 CRITICAL 9.1 MITIGATE Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M
• CVE-2024-39768 CRITICAL 9.1 MITIGATE Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M
• CVE-2024-39765 CRITICAL 9.1 MITIGATE Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wav
• CVE-2024-39764 CRITICAL 9.1 MITIGATE Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wav
• CVE-2024-39763 CRITICAL 9.1 MITIGATE Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wav
• CVE-2024-39762 CRITICAL 9.1 MITIGATE Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wav
• CVE-2024-39761 CRITICAL 10.0 MITIGATE Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink A
• CVE-2024-39760 CRITICAL 10.0 MITIGATE Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink A
• CVE-2024-39759 CRITICAL 10.0 MITIGATE Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink A
• CVE-2024-39757 CRITICAL 9.1 MITIGATE A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC300
• CVE-2024-39756 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the adm.cgi rep_as_router() functionality of Wavlink AC3000 M33A8.V5
• CVE-2024-39754 CRITICAL 10.0 MITIGATE A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505
• CVE-2024-39608 CRITICAL 10.0 MITIGATE A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505
• CVE-2024-39604 CRITICAL 9.0 MITIGATE A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V50
• CVE-2024-39603 CRITICAL 9.1 MITIGATE A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of
• CVE-2024-39602 CRITICAL 9.1 MITIGATE An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8
• CVE-2024-39370 CRITICAL 9.1 MITIGATE An arbitrary code execution vulnerability exists in the adm.cgi set_MeshAp() functionality of Wavlink AC3000 M
• CVE-2024-39367 CRITICAL 9.1 MITIGATE An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavl
• CVE-2024-39363 CRITICAL 9.6 MITIGATE A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wav
• CVE-2024-39360 CRITICAL 9.1 MITIGATE An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8
• CVE-2024-39359 CRITICAL 9.1 MITIGATE A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC
• CVE-2024-39358 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the adm.cgi set_wzap() functionality of Wavlink AC3000 M33A8.V5030.2
• CVE-2024-39357 CRITICAL 9.1 MITIGATE A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC30
• CVE-2024-39299 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the qos.cgi qos_sta_settings() functionality of Wavlink AC3000 M33A8
• CVE-2024-39294 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the adm.cgi set_wzdgw4G() functionality of Wavlink AC3000 M33A8.V503
• CVE-2024-39288 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M
• CVE-2024-39280 CRITICAL 9.1 MITIGATE An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M
• CVE-2024-39273 CRITICAL 9.0 MITIGATE A firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505
• CVE-2024-38666 CRITICAL 9.1 MITIGATE An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wav
• CVE-2024-37357 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.
• CVE-2024-37186 CRITICAL 9.1 MITIGATE An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33
• CVE-2024-37184 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5
• CVE-2024-36493 CRITICAL 9.1 MITIGATE A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavli
• CVE-2024-36295 CRITICAL 9.1 MITIGATE A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.
• CVE-2024-36290 CRITICAL 10.0 MITIGATE A buffer overflow vulnerability exists in the login.cgi Goto_chidx() functionality of Wavlink AC3000 M33A8.V50
• CVE-2024-36272 CRITICAL 9.1 MITIGATE A buffer overflow vulnerability exists in the usbip.cgi set_info() functionality of Wavlink AC3000 M33A8.V5030
• CVE-2024-36258 CRITICAL 10.0 MITIGATE A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of
• CVE-2024-34544 CRITICAL 9.1 MITIGATE A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5
• CVE-2024-34166 CRITICAL 10.0 MITIGATE An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlin
• CVE-2024-21797 CRITICAL 9.1 MITIGATE A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V503

FAQ

How do I fix wl-wn533a8 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is wl-wn533a8 firmware being exploited right now?

None of the tracked wl-wn533a8 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which wl-wn533a8 firmware CVE should I patch first?

CVE-2024-39761 currently ranks highest (72/100): Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink A.

RSS feed for wl-wn533a8 firmware · ← Back to latest CVEs