CVE-2024-39794
📋 TL;DR
This vulnerability allows authenticated attackers to bypass permissions and inject configuration commands via the ftp_port parameter in Wavlink AC3000 routers. Attackers can manipulate FTP server settings without proper authorization. Users of affected Wavlink router models with the vulnerable firmware are at risk.
💻 Affected Systems
- Wavlink AC3000 M33A8
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to reconfigure the router, intercept network traffic, establish persistent access, and potentially pivot to internal networks.
Likely Case
Unauthorized modification of FTP server configuration, potential data exfiltration via FTP, and creation of backdoors for future access.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and monitoring of configuration changes.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. The vulnerability is in a widely accessible web interface component.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Wavlink website for firmware updates
2. Download latest firmware for AC3000 M33A8
3. Backup current configuration
4. Upload and install new firmware via web interface
5. Restart router
6. Restore configuration if needed
🔧 Temporary Workarounds
Disable FTP Service
allTurn off FTP functionality if not required
Login to router web interface
Navigate to FTP settings
Disable FTP service
Restrict Web Interface Access
allLimit access to router administration interface
Configure firewall rules to restrict admin interface access
Change default admin port
Use strong authentication
🧯 If You Can't Patch
- Isolate affected routers in separate network segments with strict firewall rules
- Implement network monitoring for unusual FTP configuration changes or unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in web interface under System Status or About pageCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version is newer than V5030.210505 and test FTP configuration changes require proper authorization📡 Detection & Monitoring
Log Indicators:
- Unauthorized configuration changes to FTP settings
- Multiple failed authentication attempts followed by successful login
- Unusual FTP port configuration changes
Network Indicators:
- Unexpected FTP traffic on non-standard ports
- HTTP POST requests to nas.cgi with ftp_port parameter modifications
SIEM Query:
source="router_logs" AND (event="configuration_change" AND component="ftp") OR (uri="/cgi-bin/nas.cgi" AND method="POST" AND params CONTAINS "ftp_port")