CVE-2024-39789

The `set_ftp_cfg()` function in the `nas.cgi` script does not properly validate the value passed in the POST parameter `ftp_port`. An attacker who has access to an authenticated HTTP session can send a specially crafted HTTP request containing malicious data in this parameter. The lack of proper input sanitization enables injection of arbitrary configuration values, leading to permission bypass. The vulnerability has a scope extending beyond the component in which it occurs (Scope: Changed), which increases its criticality.

An attacker can bypass access control mechanisms and take control of the device configuration, potentially gaining full access to sensitive data, modifying system settings, or causing service unavailability (confidentiality, integrity, and availability — all threatened at HIGH level).

Patches available from the manufacturer should be applied according to the references. Details regarding updates are available in the Cisco Talos Intelligence report (TALOS-2024-2056). Until the fix is implemented, it is recommended to restrict access to the device's administrative interface exclusively to trusted hosts and to apply strong, unique authentication policies.

Wavlink AC3000 M33A8, firmware version M33A8.V5030.210505 (products: Wavlink WL-WN533A8 / WL-WN533A8 Firmware)