CVE-2024-39793

The vulnerability lies in the lack of proper validation and sanitization of the ftp_name parameter value passed in an HTTP POST request to the nas.cgi endpoint. An attacker who has access to an authenticated session can craft a specially constructed HTTP request that injects arbitrary configuration into the proftpd service running on the device. The set_nas() mechanism processes input data without appropriate controls, allowing permission bypass and manipulation of the FTP server's external configuration.

An attacker can bypass permission mechanisms, modify the proftpd service configuration and — according to the CVSS vector (S:C, C:H, I:H, A:H) — gain full control over the device with the ability to compromise the confidentiality, integrity and availability of the system, including data stored on the connected NAS resource.

Apply patches available from the manufacturer according to the references. As temporary mitigation, it is recommended to restrict access to the device's administrative panel exclusively to trusted local networks and disable NAS/FTP functionality if not required.

Wavlink AC3000 devices (model WL-WN533A8) with firmware version M33A8.V5030.210505