PT-2024-6438 · D Link · Di-7100Gv2+4

Swind1Er · Published 2024-09-09 · Updated 2024-09-09 · CVE-2024-44333

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DI-7003GV2 version 24.04.18D1 D-Link DI-7100G+V2 version 24.04.18D1 D-Link DI-7100GV2 version 24.04.18D1 D-Link DI-7200GV2 version 24.04.18E1 D-Link DI-7300G+V2 version 24.04.18D1 D-Link DI-7400G+V2 version 24.04.18D1

Description The issue concerns a Remote Command Execution vulnerability in the CGI function responsible for handling usb paswd.asp. This vulnerability exists due to the lack of measures to neutralize special elements used in the operating system command. An attacker can achieve arbitrary command execution by sending a carefully crafted malicious string to the CGI function. This may allow a remote attacker to execute arbitrary commands, potentially leading to unauthorized access and system compromise.

Recommendations For D-Link DI-7003GV2 version 24.04.18D1, restrict access to the CGI function responsible for handling usb paswd.asp to minimize the risk of exploitation. For D-Link DI-7100G+V2 version 24.04.18D1, restrict access to the CGI function responsible for handling usb paswd.asp to minimize the risk of exploitation. For D-Link DI-7100GV2 version 24.04.18D1, restrict access to the CGI function responsible for handling usb paswd.asp to minimize the risk of exploitation. For D-Link DI-7200GV2 version 24.04.18E1, restrict access to the CGI function responsible for handling usb paswd.asp to minimize the risk of exploitation. For D-Link DI-7300G+V2 version 24.04.18D1, restrict access to the CGI function responsible for handling usb paswd.asp to minimize the risk of exploitation. For D-Link DI-7400G+V2 version 24.04.18D1, patch immediately and restrict CGI access, then audit logs for signs of exploit.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-07523

CVE-2024-44333

Affected Products

Di-7003Gv2

Di-7100Gv2

Di-7200Gv2

Di-7300G+V2

Di-7400G+V2

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-44333 · Security Note
• https://bdu.fstec.ru/vul/2024-07523 · Security Note
• https://gist.github.com/Swind1er/c8656b32058e28e64f92d100c92ca12c · Note
• https://t.me/cvenotify/93854 · Telegram Post
• https://t.me/cvedetector/5115 · Telegram Post
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/oktsec/status/1833207275499978856 · Twitter Post