PT-2025-3540 · D Link · D-Link 816

Published 2024-12-30 · Updated 2025-01-18 · CVE-2024-57683

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions D-Link 816A2 FWv1.10CNB05 R1B011D88210

Description The issue is related to an access control problem in the websURLFilterAddDel component, allowing unauthenticated attackers to set the device's filter settings via a crafted POST request. This can be achieved by sending a manipulated HTTP POST request to the device. The vulnerability may allow a remote attacker to execute arbitrary code.

Recommendations For D-Link 816A2 FWv1.10CNB05 R1B011D88210, as a temporary workaround, consider disabling the websURLFilterAddDel component until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. Avoid using the vulnerable API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

BDU:2025-01508

CVE-2024-57683

Affected Products

D-Link 816

References · 8

• https://osv.dev/vulnerability/CVE-2024-57683 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57683 · Security Note
• https://bdu.fstec.ru/vul/2025-01508 · Security Note
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/websURLFilterAddDel.md · Note
• https://t.me/cvedetector/15611 · Telegram Post
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/VulmonFeeds/status/1879986993494405278 · Twitter Post
• https://twitter.com/CVEnew/status/1880625684722466906 · Twitter Post