CVE-2024-39280

The vulnerability results from insufficient validation of externally controlled configuration parameters passed to the set_smb_cfg() function in the nas.cgi script. An attacker sends a specially crafted HTTP request to the vulnerable endpoint, injecting malicious values into configuration parameters, which are then executed by the system without sanitization. Authentication is required to trigger the vulnerability, but once obtained, the exploit does not require any additional user interaction.

An attacker can execute arbitrary system commands with the privileges of the process handling the request, which in practice means the possibility of complete takeover of the device, configuration modification, data leakage, and using the device as a starting point for further attacks on the network.

Patches available from the manufacturer should be applied according to the references. Until the update is applied, it is recommended to restrict access to the device's administrative interface only to trusted hosts and to avoid exposing the management panel to the public network.

Wavlink AC3000 M33A8, firmware version V5030.210505 (products: Wavlink WL-WN533A8 Firmware, Wavlink WL-WN533A8)