CVE-2024-39795

Published Jan 14, 2025

Updated

Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the `ftp_max_sessions` POST parameter.

Affected Software

4 affected components

Wavlink AC3000 M33A8

ProFTPD ProFTPD

All of the following

Wavlink Wl-wn533a8 Firmware=m33a8.v5030.210505

Wavlink WL-WN533A8

Event History

Jan 14, 2025

CVE Published

via MITRE·02:21 PM

Data Sourced

via MITRE·02:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-39795?

CVE-2024-39795 is considered a high-severity vulnerability due to its potential to allow permission bypass.

How do I fix CVE-2024-39795?

To fix CVE-2024-39795, update the Wavlink AC3000 M33A8 or ProFTPD to the latest versions that address these vulnerabilities.

Who is affected by CVE-2024-39795?

CVE-2024-39795 affects users of the Wavlink AC3000 M33A8 and ProFTPD products.

What types of attacks can be executed using CVE-2024-39795?

Exploiting CVE-2024-39795 can lead to permission bypass through specially crafted HTTP requests.

Is authentication required to exploit CVE-2024-39795?

Yes, an authenticated HTTP request is required to trigger the vulnerabilities described in CVE-2024-39795.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.