Critical · published January 14, 2025
🚨 Multiple external config control vulnerabilities are lurking in Wavlink AC3000! An attacker only needs an authenticated HTTP request to access sensitive permissions. 🔥 Think of this like a hotel concierge who mistakenly gives guests access to rooms that aren’t theirs because they forgot to check the keycard. A misconfiguration allows unauthorized access, just like that mix-up could lead to guests wandering into other rooms! An attacker could bypass permissions and gain unauthorized control over the FTP settings, potentially compromising sensitive data or configurations. This could lead to unauthorized changes, data leakage, or even full control of the device—yikes!
Think of this like a hotel concierge who mistakenly gives guests access to rooms that aren’t theirs because they forgot to check the keycard. A misconfiguration allows unauthorized access, just like that mix-up could lead to guests wandering into other rooms! This vulnerability allows for permission bypass in the `set_nas()` functionality of the nas.cgi script due to inadequate validation of the `ftp_port` POST parameter in ProFTPD. An authenticated request can exploit the configuration flaws to change settings without proper authorization.
An attacker could bypass permissions and gain unauthorized control over the FTP settings, potentially compromising sensitive data or configurations. This could lead to unauthorized changes, data leakage, or even full control of the device—yikes! Patch your Wavlink AC3000 to version V5030.210505 immediately! Review your configurations to ensure proper checks are in place on external inputs, and consider enhancing your server logging to catch suspicious activity. 🛡️ You can tackle this vulnerability head-on! Follow these steps and secure your device in no time. You've got this! 💪