CVE-2024-39790
CVSS 3.1 Score 9.1 of 10 (high)
Details
Published Jan 14, 2025
CWE ID 15
Summary
CVE-2024-39790: Wavlink AC3000 M33A8's nas.cgi set_ftp_cfg() functionality contains multiple external configuration control vulnerabilities. These weaknesses, including a permission bypass issue and a configuration injection vulnerability in the `ftp_max_sessions` POST parameter, can be exploited through authenticated HTTP requests. An attacker who successfully triggers these vulnerabilities can potentially impact system configurations.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.