Multiple external configuration control vulnerabilities exist in the nas.cgi set_nas() ProFTPD functionality of Wavlink AC3000 M33A8.V5030.210505. An authenticated attacker can send specially crafted HTTP requests, including manipulation of the ftp_port POST parameter, to bypass permissions and inject configuration changes. This can lead to complete compromise of confidentiality, integrity, and availability of the affected device.