CVE-2024-10915

Name of the Vulnerable Software and Affected Versions D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L versions up to 20241028

Description The issue is related to the function

cgi user add

of the file

/cgi-bin/account mgr.cgi?cmd=cgi user add

, which is affected by a critical os command injection vulnerability. This vulnerability can be exploited remotely, allowing an attacker to execute arbitrary code. The manipulation of the

group

argument leads to os command injection. The complexity of an attack is rather high, and the exploitation is known to be difficult.

Recommendations For D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L versions up to 20241028, consider disabling the

cgi user add

function as a temporary workaround until a patch is available. Restrict access to the

/cgi-bin/account mgr.cgi?cmd=cgi user add

endpoint to minimize the risk of exploitation. Avoid using the

group

argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.