CVE-2024-39788
📋 TL;DR
This vulnerability allows authenticated attackers to bypass permissions and inject malicious configuration into the FTP settings of Wavlink AC3000 routers. Attackers can manipulate the ftp_name parameter to execute unauthorized configuration changes. This affects users of Wavlink AC3000 routers with the vulnerable firmware.
💻 Affected Systems
- Wavlink AC3000 M33A8
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to reconfigure router settings, potentially enabling persistent backdoor access, data exfiltration, or use as attack platform.
Likely Case
Unauthorized configuration changes to FTP settings leading to service disruption, data exposure, or credential theft.
If Mitigated
Limited impact with proper network segmentation and authentication controls preventing unauthorized access to admin interface.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates. 2. Download latest firmware. 3. Log into router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable FTP service
allTurn off FTP functionality to remove attack surface
Restrict admin interface access
allLimit access to router admin interface to trusted IPs only
🧯 If You Can't Patch
- Isolate affected routers in separate network segment with strict firewall rules
- Implement strong authentication policies and regularly rotate admin credentials
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Update sectionCheck Version:
Login to router web interface and navigate to system information pageVerify Fix Applied:
Verify firmware version has been updated beyond V5030.210505📡 Detection & Monitoring
Log Indicators:
- Unusual configuration changes to FTP settings
- Multiple failed authentication attempts followed by successful login
- Unexpected POST requests to nas.cgi with set_ftp_cfg
Network Indicators:
- Unusual FTP configuration changes from unexpected sources
- Traffic to router admin interface from unauthorized IPs
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/nas.cgi" AND method="POST" AND params CONTAINS "set_ftp_cfg")