Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 2561–2580 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39604

CVE-2024-39604

A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:22.841Z. Updated 2025-01-15T20:56:29.993Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated16 Jan 2025, 03:56 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39357

CVE-2024-39357

A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:22.249Z. Updated 2025-01-14T16:04:01.283Z.

Showing 2561 to 2580 of 4273.First page Next page

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:04 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39359

CVE-2024-39359

A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:21.683Z. Updated 2025-01-14T16:04:03.526Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:04 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-36493

CVE-2024-36493

A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:21.051Z. Updated 2025-01-14T16:03:50.526Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:03 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39603

CVE-2024-39603

A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:20.463Z. Updated 2025-01-14T16:04:09.905Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:04 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39757

CVE-2024-39757

A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:18.345Z. Updated 2025-01-14T16:04:15.221Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:04 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-34544

CVE-2024-34544

A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:06.448Z. Updated 2025-01-14T16:03:45.160Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:03 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-36272

CVE-2024-36272

A buffer overflow vulnerability exists in the usbip.cgi set_info() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:05.930Z. Updated 2025-01-14T16:03:47.353Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:03 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-36258

CVE-2024-36258

A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:05.397Z. Updated 2025-01-14T16:03:46.292Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:03 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-36295

CVE-2024-36295

A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:04.824Z. Updated 2025-01-14T16:03:49.464Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:03 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39299

CVE-2024-39299

A buffer overflow vulnerability exists in the qos.cgi qos_sta_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:04.290Z. Updated 2025-01-14T16:06:43.179Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:06 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39803

CVE-2024-39803

Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:03.732Z. Updated 2025-11-03T21:57:15.503Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39802

CVE-2024-39802

Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:03.615Z. Updated 2025-11-03T21:57:13.973Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39801

CVE-2024-39801

Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer overflow vulnerability e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:03.503Z. Updated 2025-11-03T21:57:12.518Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39800

CVE-2024-39800

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:02.899Z. Updated 2025-11-03T21:57:11.047Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39799

CVE-2024-39799

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:02.779Z. Updated 2025-11-03T21:57:09.594Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39798

CVE-2024-39798

Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:02.528Z. Updated 2025-11-03T21:57:08.157Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-38666

CVE-2024-38666

An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:01.898Z. Updated 2025-01-15T20:20:14.889Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated16 Jan 2025, 03:20 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39602

CVE-2024-39602

An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:01.049Z. Updated 2025-01-15T20:08:23.476Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated16 Jan 2025, 03:08 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39795

CVE-2024-39795

Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:00.472Z. Updated 2025-11-03T21:57:06.706Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record