CRITICAL🇵🇱 Wersja polska

CVE-2024-10915

CVSS 9.2v4.0pub. 2024-11-06upd. 2024-11-08

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument group leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Dlink Dns 320

    HW
    Dlink
    wszystkie wersje

  • Dlink Dns 320 Firmware

    OS
    Dlink
    wszystkie wersje

  • Dlink Dns 320lw

    HW
    Dlink
    wszystkie wersje

  • Dlink Dns 320lw Firmware

    OS
    Dlink
    wszystkie wersje

  • Dlink Dns 325

    HW
    Dlink
    wszystkie wersje

  • Dlink Dns 325 Firmware

    OS
    Dlink
    wszystkie wersje

  • Dlink Dns 340l

    HW
    Dlink
    wszystkie wersje

  • Dlink Dns 340l Firmware

    OS
    Dlink
    wszystkie wersje
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2024-3272CRITICAL9.8⚠ KEVPL ✓ten sam produkt

D-Link DNS-320L/325/327L/340L — zakodowane na stałe poświadczenia (hard-coded credentials)

CVE-2020-25506CRITICAL9.8⚠ KEVten sam produkt

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which...

CVE-2019-16057CRITICAL9.8⚠ KEVten sam produkt

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

CVE-2024-10914CRITICAL9.2PL ✓ten sam produkt

Command injection w D-Link DNS-320/325/340L — zdalne wykonanie poleceń OS

CVE-2014-7859CRITICAL9.8ten sam produkt

Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322...