CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2024-10914

CVSS 9.2v4.0pub. 2024-11-06upd. 2024-11-24

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument name leads to os command injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Dlink Dns 320

    HW
    Dlink
    wszystkie wersje

  • Dlink Dns 320 Firmware

    OS
    Dlink
    wszystkie wersje

  • Dlink Dns 320lw

    HW
    Dlink
    wszystkie wersje

  • Dlink Dns 320lw Firmware

    OS
    Dlink
    wszystkie wersje

  • Dlink Dns 325

    HW
    Dlink
    wszystkie wersje

  • Dlink Dns 325 Firmware

    OS
    Dlink
    wszystkie wersje

  • Dlink Dns 340l

    HW
    Dlink
    wszystkie wersje

  • Dlink Dns 340l Firmware

    OS
    Dlink
    wszystkie wersje
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2024-3272CRITICAL9.8⚠ KEVPL ✓ten sam produkt

D-Link DNS-320L/325/327L/340L — zakodowane na stałe poświadczenia (hard-coded credentials)

CVE-2020-25506CRITICAL9.8⚠ KEVten sam produkt

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which...

CVE-2019-16057CRITICAL9.8⚠ KEVten sam produkt

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

CVE-2024-10915CRITICAL9.2PL ✓ten sam produkt

Command injection w D-Link DNS-320/325/340L przez parametr group

CVE-2014-7859CRITICAL9.8ten sam produkt

Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322...