CVE-2024-39788
Published: 14 January 2025
Summary
CVE-2024-39788 is a critical-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Wavlink Wl-Wn533A8 Firmware. Its CVSS base score is 9.1 (Critical).
Operationally, ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-5 (Access Restrictions for Change).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates inputs like the ftp_name POST parameter to prevent configuration injection and external control of file name or path (CWE-15).
Restricts access to configuration change functions such as set_ftp_cfg() to authorized users only, mitigating permission bypass in config controls.
Enforces approved authorizations in nas.cgi to block permission bypass via specially crafted authenticated HTTP requests.
NVD Description
Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability…
more
exists within the `ftp_name` POST parameter.
Deeper analysisAI
CVE-2024-39788 involves multiple external config control vulnerabilities in the nas.cgi set_ftp_cfg() functionality of the Wavlink AC3000 router running firmware version M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass, with a specific configuration injection vulnerability in the ftp_name POST parameter. The vulnerability, published on 2025-01-14, is rated with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-15 (External Control of File Name or Path).
An authenticated attacker with high privileges (PR:H) can exploit these vulnerabilities by sending a specially crafted HTTP request over the network (AV:N) with low complexity (AC:L) and no user interaction required (UI:N). Exploitation triggers permission bypass and configuration injection, resulting in high impacts to confidentiality, integrity, and availability, along with a change in scope (S:C).
Mitigation details are provided in the Talos Intelligence advisory TALOS-2024-2056, available at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2056.
Details
- CWE(s)