PT-2025-3535 · D Link · D-Link 816

Published 2024-12-30 · Updated 2025-02-03 · CVE-2024-57677

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link 816A2 FWv1.10CNB05 R1B011D88210

Description An access control issue in the component form2Wan.cgi of D-Link devices allows unauthenticated attackers to configure the WAN service of the device via a crafted POST request to the "form2Wan.cgi" endpoint. This issue is related to insufficient access control, which can be exploited by a remote attacker using a specially crafted HTTP POST request.

Recommendations For D-Link 816A2 FWv1.10CNB05 R1B011D88210, as a temporary workaround, consider disabling the form2Wan.cgi component until a patch is available. Restrict access to the form2Wan.cgi endpoint to minimize the risk of exploitation. Avoid using the form2Wan.cgi endpoint in the device's configuration until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

BDU:2025-01515

CVE-2024-57677

Affected Products

D-Link 816

References · 9

• https://bdu.fstec.ru/vul/2025-01515 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57677 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57677 · Vendor Advisory
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2Wan.md · Note
• https://t.me/cvenotify/109751 · Telegram Post
• https://t.me/cvedetector/15605 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1880004914111242600 · Twitter Post
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/CVEnew/status/1880625679664046421 · Twitter Post