https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-39803.htmlhttps://patchthecve.com/cve/CVE-2024-39803.htmlWed, 17 Jun 2026 07:42:49 +0000CRITICAL 9.1: Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overhttps://patchthecve.com/cve/CVE-2024-39802.htmlhttps://patchthecve.com/cve/CVE-2024-39802.htmlWed, 17 Jun 2026 07:42:49 +0000CRITICAL 9.1: Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overhttps://patchthecve.com/cve/CVE-2024-39801.htmlhttps://patchthecve.com/cve/CVE-2024-39801.htmlWed, 17 Jun 2026 07:42:49 +0000CRITICAL 9.1: Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overhttps://patchthecve.com/cve/CVE-2024-39800.htmlhttps://patchthecve.com/cve/CVE-2024-39800.htmlWed, 17 Jun 2026 07:42:49 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabhttps://patchthecve.com/cve/CVE-2024-39799.htmlhttps://patchthecve.com/cve/CVE-2024-39799.htmlWed, 17 Jun 2026 07:42:49 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabhttps://patchthecve.com/cve/CVE-2024-39798.htmlhttps://patchthecve.com/cve/CVE-2024-39798.htmlWed, 17 Jun 2026 07:42:49 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabhttps://patchthecve.com/cve/CVE-2024-39795.htmlhttps://patchthecve.com/cve/CVE-2024-39795.htmlWed, 17 Jun 2026 07:42:49 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurathttps://patchthecve.com/cve/CVE-2024-39794.htmlhttps://patchthecve.com/cve/CVE-2024-39794.htmlWed, 17 Jun 2026 07:42:49 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurathttps://patchthecve.com/cve/CVE-2024-39793.htmlhttps://patchthecve.com/cve/CVE-2024-39793.htmlWed, 17 Jun 2026 07:42:48 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurathttps://patchthecve.com/cve/CVE-2024-39790.htmlhttps://patchthecve.com/cve/CVE-2024-39790.htmlWed, 17 Jun 2026 07:42:48 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration https://patchthecve.com/cve/CVE-2024-39789.htmlhttps://patchthecve.com/cve/CVE-2024-39789.htmlWed, 17 Jun 2026 07:42:48 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration https://patchthecve.com/cve/CVE-2024-39788.htmlhttps://patchthecve.com/cve/CVE-2024-39788.htmlWed, 17 Jun 2026 07:42:48 +0000CRITICAL 9.1: Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration https://patchthecve.com/cve/CVE-2024-39787.htmlhttps://patchthecve.com/cve/CVE-2024-39787.htmlWed, 17 Jun 2026 07:42:48 +0000CRITICAL 9.1: Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A directory traversal vuhttps://patchthecve.com/cve/CVE-2024-39786.htmlhttps://patchthecve.com/cve/CVE-2024-39786.htmlWed, 17 Jun 2026 07:42:48 +0000CRITICAL 9.1: Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A directory traversal vuhttps://patchthecve.com/cve/CVE-2024-39785.htmlhttps://patchthecve.com/cve/CVE-2024-39785.htmlWed, 17 Jun 2026 07:42:47 +0000CRITICAL 9.1: Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injecthttps://patchthecve.com/cve/CVE-2024-39784.htmlhttps://patchthecve.com/cve/CVE-2024-39784.htmlWed, 17 Jun 2026 07:42:47 +0000CRITICAL 9.1: Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injecthttps://patchthecve.com/cve/CVE-2024-39783.htmlhttps://patchthecve.com/cve/CVE-2024-39783.htmlWed, 17 Jun 2026 07:42:47 +0000CRITICAL 9.1: Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command ihttps://patchthecve.com/cve/CVE-2024-39782.htmlhttps://patchthecve.com/cve/CVE-2024-39782.htmlWed, 17 Jun 2026 07:42:47 +0000CRITICAL 9.1: Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command ihttps://patchthecve.com/cve/CVE-2024-39781.htmlhttps://patchthecve.com/cve/CVE-2024-39781.htmlWed, 17 Jun 2026 07:42:47 +0000CRITICAL 9.1: Multiple OS command injection vulnerabilities exist in the adm.cgi sch_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command ihttps://patchthecve.com/cve/CVE-2024-39774.htmlhttps://patchthecve.com/cve/CVE-2024-39774.htmlWed, 17 Jun 2026 07:42:40 +0000CRITICAL 9.1: A buffer overflow vulnerability exists in the adm.cgi set_sys_adm() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39773.htmlhttps://patchthecve.com/cve/CVE-2024-39773.htmlWed, 17 Jun 2026 07:42:39 +0000MEDIUM 5.3: An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39770.htmlhttps://patchthecve.com/cve/CVE-2024-39770.htmlWed, 17 Jun 2026 07:42:39 +0000CRITICAL 9.1: Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerabhttps://patchthecve.com/cve/CVE-2024-39769.htmlhttps://patchthecve.com/cve/CVE-2024-39769.htmlWed, 17 Jun 2026 07:42:39 +0000CRITICAL 9.1: Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerabhttps://patchthecve.com/cve/CVE-2024-39768.htmlhttps://patchthecve.com/cve/CVE-2024-39768.htmlWed, 17 Jun 2026 07:42:39 +0000CRITICAL 9.1: Multiple buffer overflow vulnerabilities exist in the internet.cgi set_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerabhttps://patchthecve.com/cve/CVE-2024-39765.htmlhttps://patchthecve.com/cve/CVE-2024-39765.htmlWed, 17 Jun 2026 07:42:37 +0000CRITICAL 9.1: Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.https://patchthecve.com/cve/CVE-2024-39764.htmlhttps://patchthecve.com/cve/CVE-2024-39764.htmlWed, 17 Jun 2026 07:42:37 +0000CRITICAL 9.1: Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.https://patchthecve.com/cve/CVE-2024-39763.htmlhttps://patchthecve.com/cve/CVE-2024-39763.htmlWed, 17 Jun 2026 07:42:36 +0000CRITICAL 9.1: Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.https://patchthecve.com/cve/CVE-2024-39762.htmlhttps://patchthecve.com/cve/CVE-2024-39762.htmlWed, 17 Jun 2026 07:42:36 +0000CRITICAL 9.1: Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.https://patchthecve.com/cve/CVE-2024-39761.htmlhttps://patchthecve.com/cve/CVE-2024-39761.htmlWed, 17 Jun 2026 07:42:36 +0000CRITICAL 10.0: Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A commahttps://patchthecve.com/cve/CVE-2024-39760.htmlhttps://patchthecve.com/cve/CVE-2024-39760.htmlWed, 17 Jun 2026 07:42:36 +0000CRITICAL 10.0: Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A commahttps://patchthecve.com/cve/CVE-2024-39759.htmlhttps://patchthecve.com/cve/CVE-2024-39759.htmlWed, 17 Jun 2026 07:42:36 +0000CRITICAL 10.0: Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A commahttps://patchthecve.com/cve/CVE-2024-39757.htmlhttps://patchthecve.com/cve/CVE-2024-39757.htmlWed, 17 Jun 2026 07:42:36 +0000CRITICAL 9.1: A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39756.htmlhttps://patchthecve.com/cve/CVE-2024-39756.htmlWed, 17 Jun 2026 07:42:36 +0000CRITICAL 9.1: A buffer overflow vulnerability exists in the adm.cgi rep_as_router() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39754.htmlhttps://patchthecve.com/cve/CVE-2024-39754.htmlWed, 17 Jun 2026 07:42:35 +0000CRITICAL 10.0: A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39608.htmlhttps://patchthecve.com/cve/CVE-2024-39608.htmlWed, 17 Jun 2026 07:42:19 +0000CRITICAL 10.0: A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can send an unauthenticated message to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39604.htmlhttps://patchthecve.com/cve/CVE-2024-39604.htmlWed, 17 Jun 2026 07:42:18 +0000CRITICAL 9.0: A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39603.htmlhttps://patchthecve.com/cve/CVE-2024-39603.htmlWed, 17 Jun 2026 07:42:18 +0000CRITICAL 9.1: A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39602.htmlhttps://patchthecve.com/cve/CVE-2024-39602.htmlWed, 17 Jun 2026 07:42:18 +0000CRITICAL 9.1: An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39370.htmlhttps://patchthecve.com/cve/CVE-2024-39370.htmlWed, 17 Jun 2026 07:41:48 +0000CRITICAL 9.1: An arbitrary code execution vulnerability exists in the adm.cgi set_MeshAp() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39367.htmlhttps://patchthecve.com/cve/CVE-2024-39367.htmlWed, 17 Jun 2026 07:41:48 +0000CRITICAL 9.1: An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39363.htmlhttps://patchthecve.com/cve/CVE-2024-39363.htmlWed, 17 Jun 2026 07:41:47 +0000CRITICAL 9.6: A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnehttps://patchthecve.com/cve/CVE-2024-39360.htmlhttps://patchthecve.com/cve/CVE-2024-39360.htmlWed, 17 Jun 2026 07:41:47 +0000CRITICAL 9.1: An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39359.htmlhttps://patchthecve.com/cve/CVE-2024-39359.htmlWed, 17 Jun 2026 07:41:47 +0000CRITICAL 9.1: A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39358.htmlhttps://patchthecve.com/cve/CVE-2024-39358.htmlWed, 17 Jun 2026 07:41:47 +0000CRITICAL 9.1: A buffer overflow vulnerability exists in the adm.cgi set_wzap() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39357.htmlhttps://patchthecve.com/cve/CVE-2024-39357.htmlWed, 17 Jun 2026 07:41:47 +0000CRITICAL 9.1: A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39299.htmlhttps://patchthecve.com/cve/CVE-2024-39299.htmlWed, 17 Jun 2026 07:41:40 +0000CRITICAL 9.1: A buffer overflow vulnerability exists in the qos.cgi qos_sta_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39294.htmlhttps://patchthecve.com/cve/CVE-2024-39294.htmlWed, 17 Jun 2026 07:41:39 +0000CRITICAL 9.1: A buffer overflow vulnerability exists in the adm.cgi set_wzdgw4G() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39288.htmlhttps://patchthecve.com/cve/CVE-2024-39288.htmlWed, 17 Jun 2026 07:41:39 +0000CRITICAL 9.1: A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39280.htmlhttps://patchthecve.com/cve/CVE-2024-39280.htmlWed, 17 Jun 2026 07:41:37 +0000CRITICAL 9.1: An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.https://patchthecve.com/cve/CVE-2024-39273.htmlhttps://patchthecve.com/cve/CVE-2024-39273.htmlWed, 17 Jun 2026 07:41:35 +0000CRITICAL 9.0: A firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.