CVE-2024-39790
📋 TL;DR
This vulnerability allows authenticated attackers to bypass permissions and inject configuration parameters in Wavlink AC3000 routers. Attackers can manipulate FTP session limits and other settings through crafted HTTP requests. Only users of specific Wavlink router models with vulnerable firmware are affected.
💻 Affected Systems
- Wavlink AC3000 M33A8
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing configuration of backdoors, network redirection, or disabling security features, potentially leading to full network infiltration.
Likely Case
Unauthorized configuration changes to FTP settings, potential denial of service through session manipulation, and privilege escalation within the router administration interface.
If Mitigated
Limited impact with proper network segmentation and access controls preventing unauthorized users from reaching the vulnerable interface.
🎯 Exploit Status
Exploitation requires authenticated access but uses simple HTTP POST requests. No public exploit code available as of knowledge cutoff.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates. 2. Download latest firmware for AC3000 M33A8. 3. Log into router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router after update completes.
🔧 Temporary Workarounds
Disable FTP Service
allTurn off FTP functionality to remove attack surface
Restrict Admin Interface Access
allLimit access to router admin interface to trusted IPs only
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Disable remote administration and ensure admin interface is only accessible from internal network
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Status or Firmware Update sectionCheck Version:
Login to router web interface and navigate to System Information pageVerify Fix Applied:
Verify firmware version is newer than V5030.210505 and test FTP configuration changes require proper authentication📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to nas.cgi with set_ftp_cfg parameter
- Multiple failed authentication attempts followed by configuration changes
- Unexpected FTP service configuration modifications
Network Indicators:
- HTTP traffic to router admin interface from unexpected sources
- POST requests containing ftp_max_sessions parameter manipulation
SIEM Query:
source_ip=* AND dest_ip=[router_ip] AND url_path="*nas.cgi*" AND http_method="POST" AND params="*set_ftp_cfg*"