CVE-2024-48705 is a command injection vulnerability affecting Wavlink AC1200 firmware versions M32A3_V1410_230602 and M32A3_V1410_240222. The flaw exists in the 'set_sys_adm' function of the 'adm.cgi' binary, where the 'newpass' parameter is not properly sanitized, enabling post-authentication command injection during password reset. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity. There is no known exploit in the wild and no vendor-provided patch or mitigation details at this time.

An authenticated attacker can exploit this vulnerability to execute arbitrary commands on the affected device during the password reset process, potentially compromising system confidentiality and integrity. Availability is not impacted. The vulnerability requires no user interaction and has low attack complexity, increasing the risk if credentials are obtained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's administrative interface to trusted users only and monitor for suspicious activity related to password reset operations.