CVE-2024-39793
CVE-2024-39793: Wavlink AC3000 router is susceptible to permission bypass and configuration injection vulnerabilities. This flaw in the nas.cgi set_nas() function's proftpd functionality allows attackers to manipulate configurations. Specifically, the ftp_name POST parameter is vulnerable to configuration injection, potentially leading to unauthorized access.
An authenticated attacker can exploit this by sending a specially crafted HTTP request. While the CVSS score is high at 9.1, the SOCRadar Vulnerability Risk Score (SVRS) is 42, suggesting a lower immediate risk compared to critical vulnerabilities with SVRS scores above 80, but it still requires monitoring. This vulnerability can allow attackers to make changes to the device configuration without proper authorization. This poses a risk of system compromise. While not immediately critical based on SVRS, it should still be addressed by applying available security patches to prevent potential exploitation of the vulnerability.
Description
CVE-2024-39793 affects the Wavlink AC3000 M33A8.V5030.210505 router, specifically its nas.cgi set_nas() proftpd functionality. This vulnerability arises from multiple external configuration control issues, allowing a malicious actor to bypass permission restrictions through a specially crafted HTTP request. Notably, a configuration injection vulnerability exists within the ftp_name POST parameter.
SVRS: 42 - While the CVSS score is high (9.1), the SVRS score indicates a moderate risk, signifying that immediate action may not be urgently required. This discrepancy highlights the importance of SOCRadar's approach in assessing vulnerabilities by considering real-world exploitation context.
Key Insights
- Permission Bypass: This vulnerability enables attackers to circumvent access restrictions, potentially granting them unauthorized control over the router's settings and files.
- Configuration Injection: Attackers can inject malicious code or configurations into the router's settings through the vulnerable
ftp_nameparameter, potentially compromising the router's functionality and security. - Authenticated Request: Exploitation requires an authenticated user, meaning attackers would need to compromise user accounts or exploit other vulnerabilities to gain access.
- In The Wild: This vulnerability has been observed in active exploitation attempts by malicious actors.
Mitigation Strategies
- Update Firmware: Immediately update the router's firmware to the latest version, as it likely addresses this vulnerability.
- Disable FTP Server: If possible, disable the FTP server functionality on the router to mitigate the risk of exploitation.
- Strong Passwords: Ensure users are using strong and unique passwords for their router and any associated accounts.
- Security Monitoring: Implement security monitoring solutions to detect suspicious network activity and potential exploitation attempts.
Additional Information
If you have further questions about this incident or require additional information, please utilize the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.