CVE-2024-10915

Name of the Vulnerable Software and Affected Versions D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L versions up to 20241028

Description A critical issue exists in the cgi user add function of the file /cgi-bin/account mgr.cgi?cmd=cgi user add within the affected D-Link devices. Manipulation of the argument group allows for operating system command injection. This allows a remote attacker to execute arbitrary commands on the system. The complexity of a successful attack is considered high, and while exploitation is difficult, a public exploit is available.

Recommendations Update D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L to a version later than 20241028.