Vulnerability details

CVE-2024-39788

Wavlink AC3000

CVSS 3.1

9.1Critical

Official description

Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists within the `ftp_name` POST parameter.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CVEProject cvelistV5 (CNA) (talos)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Wavlink	Wavlink AC3000	M33A8.V5030.210505	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-01-14
Last updated: 2025-11-04
State: Published
Assigner (CNA): talos

Exploit prediction (EPSS)

1.55%

Probability of exploitation in 30 days

75.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-15
External Control of System or Configuration Setting