CVE-2024-39794

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerability exists in the `ftp_port` POST parameter.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-15

Affected software

No affected versions have been published.

Timeline

Published: Jan 14, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-397957.2Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. CVE-2024-397976.5Improper access control in some drivers for Intel(R) Ethernet Connection I219 Series before version 12.19.1.39 may allow an authenticated us CVE-2024-397987.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503 CVE-2024-397997.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503 CVE-2024-39808.8The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesyst CVE-2024-398007.2Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V503 CVE-2024-398017.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398027.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398037.2Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially CVE-2024-398049.1A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can leverage PowerPoint's acce CVE-2024-398057.8Insufficient verification of data authenticity in some Intel(R) DSA software before version 23.4.39 may allow an authenticated user to poten CVE-2024-398065.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.