PT-2024-6464 · D Link · D-Link Dns-1200-05+16

Buaaiotteam

·

Published

2024-04-04

·

Updated

2024-08-31

·

CVE-2024-8213

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 versions up to 20240814
Description A critical vulnerability has been found in the function cgi FMT R12R5 1st DiskMGR of the file /cgi-bin/hd config.cgi. The manipulation of the argument f source dev leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This issue only affects products that are no longer supported by the maintainer, and the vendor has confirmed that the product is end-of-life.
Recommendations As a temporary workaround, consider disabling the cgi FMT R12R5 1st DiskMGR function until a replacement is available. Restrict access to the /cgi-bin/hd config.cgi file to minimize the risk of exploitation. Avoid using the f source dev argument in the affected API endpoint until the issue is resolved. The vendor recommends retiring and replacing the affected products, as they are no longer supported.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

BDU:2024-07550
CVE-2024-8213

Affected Products

D-Link Dnr-202L
D-Link Dnr-322L
D-Link Dns-326
D-Link Dns-1100-4
D-Link Dns-120
D-Link Dns-1200-05
D-Link Dns-1550-04
D-Link Dns-315L
D-Link Dns-320
D-Link Dns-321
D-Link Dns-323
D-Link Dns-325
D-Link Dns-327L
D-Link Dns-340L
D-Link Dns-343
D-Link Dns-345
D-Link Dns-726-4