PT-2024-3696 · D Link · D-Link Dar-7000-40+2

H0E4A0R1T · Published 2024-05-15 · Updated 2024-08-01 · CVE-2024-4963

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DAR-7000-40 version V31R02B1413C D-Link DAR-7000 (affected versions not specified) D-Link DAR-8000 (affected versions not specified)

Description A critical issue affects an unknown part of the file /url/url.php, allowing for unrestricted upload through the manipulation of the file upload argument. This can be initiated remotely, potentially leading to the execution of arbitrary code. The exploit has been disclosed publicly.

Recommendations For D-Link DAR-7000-40 version V31R02B1413C: Consider retiring and replacing the product as it is end-of-life. For D-Link DAR-7000 and D-Link DAR-8000: As these products are also affected but specific versions are not provided, it is recommended to check with the vendor for the latest information on retirement and replacement, given their end-of-life status. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2024-04040

CVE-2024-4963

Affected Products

D-Link Dar-7000

D-Link Dar-7000-40

D-Link Dar-8000

References · 10

• 🔥 https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20url.php.pdf · Exploit
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04040 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4963 · Security Note
• https://t.me/cvenotify/79983 · Telegram Post
• https://vuldb.com/?id.264531 · Note
• https://vuldb.com/?ctiid.264531 · Note
• https://t.me/cvenotify/88347 · Telegram Post
• https://vuldb.com/?submit.333781 · Note