CVE-2024-39795 is a critical vulnerability in the nas.cgi set_nas() ProFTPD functionality of Wavlink AC3000 M33A8.V5030.210505. It involves multiple external configuration control flaws, including a configuration injection via the ftp_max_sessions POST parameter. An authenticated attacker can send specially crafted HTTP requests to bypass permissions, potentially leading to full compromise of confidentiality, integrity, and availability.