PT-2025-3536 · D Link · D-Link Dir-816

Published 2024-12-30 · Updated 2025-02-03 · CVE-2024-57678

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-816A2 versions 1.10CNB05 R1B011D88210

Description The issue is related to an access control problem in the form2WlAc.cgi component, allowing unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request to the "form2WlAc.cgi" endpoint, using variables such as mac access control list. This can be achieved by sending a specially crafted HTTP POST request.

Recommendations For version 1.10CNB05 R1B011D88210, as a temporary workaround, consider disabling the form2WlAc.cgi component until a patch is available. Restrict access to the form2WlAc.cgi endpoint to minimize the risk of exploitation. Avoid using the mac access control list variables in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

BDU:2025-01514

CVE-2024-57678

Affected Products

D-Link Dir-816

References · 9

• https://osv.dev/vulnerability/CVE-2024-57678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57678 · Security Note
• https://bdu.fstec.ru/vul/2025-01514 · Security Note
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2WlAc.md · Note
• https://twitter.com/CVEnew/status/1880625680511369611 · Twitter Post
• https://t.me/cvenotify/109752 · Telegram Post
• https://t.me/cvedetector/15606 · Telegram Post
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/VulmonFeeds/status/1879999793893621945 · Twitter Post