CVE-2024-39363: Wavlink AC3000 login.cgi set_lang_CountryCode XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityCVSS 6.1 medium with user interaction required, but high EPSS and public exploit references raise the practical risk.

What it is

A cross-site scripting flaw exists in the set_lang_CountryCode() functionality of login.cgi in Wavlink AC3000 firmware M33A8.V5030.210505. A crafted HTTP request can inject script that discloses sensitive information. The record does not specify the exact affected version range beyond the firmware string given.

Impact

An attacker can execute script in a victim's browser context, potentially disclosing sensitive information such as session data or credentials. The CVSS vector rates confidentiality and availability impact as low.

Attack surface

Reachable over the network via HTTP to login.cgi; no authentication is required to send the request, but the CVSS vector requires user interaction (UI:R), meaning a victim must be induced to trigger the crafted request.

Exploitation

Not listed in CISA KEV and no ransomware usage documented. EPSS is high at 0.48086 (98.8th percentile), and both references are tagged Exploit, indicating public exploit detail exists.

What to do

• Apply the vendor firmware update for Wavlink AC3000 once available; check Wavlink advisories for the fixed build.
• Restrict management interface access to trusted networks and disable remote WAN administration if not needed.
• Deploy a WAF or input filtering to block script payloads targeting login.cgi parameters.
• Educate users not to follow untrusted links to the device login page.
• Monitor Wavlink advisories for a patched firmware release since the record does not name one.

Detection

• Inspect HTTP requests to login.cgi for script tags or encoded script in the set_lang_CountryCode parameter.
• Alert on anomalous or malformed language/country code values in login.cgi traffic.
• Review web logs for reflected payloads returning to clients from login.cgi.
• Correlate outbound connections from the device after suspicious login.cgi requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.