CVE-2024-39786
📋 TL;DR
This directory traversal vulnerability in Wavlink AC3000 routers allows authenticated attackers to bypass file permissions and access restricted directories. Attackers can exploit the 'adddir_name' POST parameter in nas.cgi to traverse outside intended directories. This affects users of Wavlink AC3000 routers with vulnerable firmware.
💻 Affected Systems
- Wavlink AC3000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to read sensitive files, modify system configurations, or potentially execute arbitrary code with router privileges.
Likely Case
Unauthorized access to sensitive files including configuration files, logs, and potentially credentials stored on the router's filesystem.
If Mitigated
Limited impact if proper network segmentation and access controls prevent attackers from reaching the vulnerable interface.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. The Talos report includes technical details that could be used to create exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found at time of analysis
Restart Required: No
Instructions:
1. Check Wavlink website for firmware updates
2. If update available, download and install via router web interface
3. Verify version is newer than M33A8.V5030.210505
🔧 Temporary Workarounds
Disable NAS functionality
allTurn off the Network Attached Storage features if not needed
Access router web interface > NAS settings > Disable NAS services
Restrict web interface access
allLimit access to router administration interface
Configure firewall rules to restrict access to router IP on ports 80/443
🧯 If You Can't Patch
- Change default credentials and use strong authentication
- Implement network segmentation to isolate the router from sensitive networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: System Status > Firmware VersionCheck Version:
No CLI command available - use web interface at http://router-ipVerify Fix Applied:
Verify firmware version is newer than M33A8.V5030.210505📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /cgi-bin/nas.cgi with suspicious adddir_name parameters containing '../' sequences
Network Indicators:
- Unusual file access patterns from router IP
- Multiple failed authentication attempts followed by successful login and directory traversal attempts
SIEM Query:
source="router_logs" AND uri="/cgi-bin/nas.cgi" AND (method="POST" OR parameters CONTAINS "adddir_name")