CVE-2024-39798 is a critical vulnerability in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. It allows an authenticated attacker to execute arbitrary commands via specially crafted HTTP requests, exploiting multiple external configuration control flaws including a configuration injection in the sel_open_protocol POST parameter.