CVE-2024-39790

The vulnerability concerns a POST parameter named ftp_max_sessions, passed to the set_ftp_cfg() function in the nas.cgi script. This function does not properly validate the value supplied by the user, which enables injection of malicious configuration directives (CWE-15 — External Control of System or Configuration Setting). An attacker possessing credentials to the management panel can send a specially crafted HTTP request, which will cause permission control mechanisms to be bypassed and dangerous configuration to be saved on the device.

Successful exploitation of this vulnerability allows an attacker to perform unauthorized modification of system configuration, which may lead to complete takeover of the device, loss of confidentiality, integrity, and availability of supported network resources.

Apply patches available from the manufacturer according to references. It is recommended to monitor Wavlink manufacturer updates and Cisco Talos security advisory (TALOS-2024-2056). Temporarily restrict access to the device's administrative panel exclusively to trusted IP addresses and disable unnecessary network services (e.g., FTP) if not required.

Wavlink AC3000 devices (WL-WN533A8 models) with firmware version M33A8.V5030.210505