PT-2024-5843 · D Link · D-Link Dir-846

Published

2024-08-27

·

Updated

2024-09-04

·

CVE-2024-44340

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions D-Link DIR-846W A1 FW100A43
Description A remote command execution vulnerability was discovered in the D-Link DIR-846W A1 FW100A43, related to the SetSmartQoSSettings function. This issue allows a remote attacker to execute arbitrary code by manipulating the smartqos express devices and smartqos normal devices parameters.
Recommendations As a temporary workaround, consider disabling the SetSmartQoSSettings function until a patch is available. Restrict access to the smartqos express devices and smartqos normal devices parameters in the SetSmartQoSSettings function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-06588
CVE-2024-44340

Affected Products

D-Link Dir-846