CVE-2024-39789

Summary

CVE-2024-39789 is a vulnerability affecting the Wavlink AC3000 M33A8 router's nas.cgi set_ftp_cfg() functionality. Multiple external configuration control vulnerabilities have been discovered, which can be exploited through a specially crafted HTTP request. An attacker with authenticated access can bypass permissions and leverage these vulnerabilities, specifically targeting the `ftp_port` POST parameter for configuration injection. This issue poses a significant risk to the security of affected routers, emphasizing the importance of prompt patches and secure configuration management.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.