Critical · published January 14, 2025
🔥 Multiple external config control vulnerabilities in your Wavlink AC3000 could allow attackers to bypass permissions with just a crafted HTTP request! 🚨 It's like a pizza delivery guy being able to slip into your house because nobody checked his delivery slip — all it takes is one small oversight! This means an attacker could waltz right in and change your FTP settings, potentially allowing unauthorized access or even disrupting your entire network. The consequences could be absolutely devastating; imagine someone hijacking your files or overloading your FTP server!
It's like a pizza delivery guy being able to slip into your house because nobody checked his delivery slip — all it takes is one small oversight! The vulnerabilities stem from the `set_ftp_cfg()` functionality in nas.cgi, allowing an authenticated user to exploit the `ftp_max_sessions` POST parameter for configuration injection and permission bypass.
This means an attacker could waltz right in and change your FTP settings, potentially allowing unauthorized access or even disrupting your entire network. The consequences could be absolutely devastating; imagine someone hijacking your files or overloading your FTP server! Immediately patch your Wavlink AC3000 to the latest version to close these critical vulnerabilities. Review your FTP settings and ensure strict permissions are enforced to mitigate the risk of unauthorized access. You've got this! With these updates, you can secure your setup and maintain your hero status! 🛡️