PT-2024-7081 · D Link · D-Link Dir-878+1

Published 2024-09-26 · Updated 2024-10-18 · CVE-2024-48633

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DIR-878 version DIR 878 FW130B08 D-Link DIR-882 version DIR 882 FW130B06

Description The issue exists due to the lack of neutralization of special elements used in the operating system command in the SetVirtualServerSettings() function of the prog.cgi script in the D-Link DIR-878 and DIR-882 router firmware. This allows a remote attacker to execute arbitrary commands by sending a specially crafted POST request. The vulnerability is exploited via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function.

Recommendations For D-Link DIR-878 version DIR 878 FW130B08, consider disabling the SetVirtualServerSettings() function until a patch is available to prevent exploitation. For D-Link DIR-882 version DIR 882 FW130B06, restrict access to the prog.cgi script to minimize the risk of exploitation, especially for the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-08340

CVE-2024-48633

Affected Products

D-Link Dir-878

D-Link Dir-882

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-48633 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48633 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08340 · Security Note
• https://vuldb.com/?id.280789 · Note
• https://github.com/advisories/GHSA-22c8-79jr-rvwg · Note
• ❌ https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_40/40.md · Note, Deleted
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/CVEnew/status/1846970164312498617 · Twitter Post