CVEvulnerability

CVE-2024-36821

6.8 MEDIUM Published 2024-06-11 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2024-06-11
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 6.8 MEDIUM — CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-379, CWE-732

Description

Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root.

Affected configurations

• linksys velop whw0101 firmware 1.1.13.202617

Related

Weakness · CWE (2)

CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness
CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References

https://downloads.linksys.com/support/assets/releasenotes/WHW01_VLP01_1.1.13.202617_Customer_Release_Notes.txt Release Notes
https://github.com/IvanGlinkin/CVE-2024-36821 Exploit, Third Party Advisory
https://downloads.linksys.com/support/assets/releasenotes/WHW01_VLP01_1.1.13.202617_Customer_Release_Notes.txt Release Notes
https://github.com/IvanGlinkin/CVE-2024-36821 Exploit, Third Party Advisory