PT-2024-6486 · D Link · Dns-340L+18

Buaai0Tteam

·

Published

2024-04-04

·

Updated

2024-08-23

·

CVE-2024-7922

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 up to 20240814
Description A critical issue affects the function cgi audio search, cgi create playlist, cgi get album all tracks, cgi get alltracks editlist, cgi get artist all album, cgi get genre all tracks, cgi get tracks list, cgi set airplay content, and cgi write playlist of the file /cgi-bin/myMusic.cgi. This issue leads to command injection and can be exploited remotely. The exploit has been disclosed to the public. Note that this issue only affects products that are no longer supported by the maintainer and should be retired and replaced.
Recommendations As a temporary workaround, consider disabling the cgi audio search, cgi create playlist, cgi get album all tracks, cgi get alltracks editlist, cgi get artist all album, cgi get genre all tracks, cgi get tracks list, cgi set airplay content, and cgi write playlist functions of the /cgi-bin/myMusic.cgi file until a patch is available. Restrict access to the /cgi-bin/myMusic.cgi file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-07578
CVE-2024-7922

Affected Products

D-Link Dns-120
Dnr-202L
Dnr-322L
Dnr-326
Dns-1100-4
Dns-1200-05
Dns-1550-04
Dns-315L
Dns-320
Dns-320L
Dns-321
Dns-323
Dns-325
Dns-326
Dns-327L
Dns-340L
Dns-343
Dns-345
Dns-726-4