PT-2025-3541 · D Link · D-Link 816

Published 2024-12-30 · Updated 2025-01-18 · CVE-2024-57684

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link 816A2 FWv1.10CNB05 R1B011D88210

Description The issue is related to an access control problem in the formDMZ.cgi component, which allows unauthenticated attackers to configure the DMZ service of the device through a crafted POST request. This can potentially enable remote attackers to execute arbitrary code using a specially crafted HTTP POST request.

Recommendations For D-Link 816A2 FWv1.10CNB05 R1B011D88210, as a temporary workaround, consider disabling the formDMZ.cgi component until a patch is available. Restrict access to the DMZ service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2025-01399

CVE-2024-57684

Affected Products

D-Link 816

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-57684 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57684 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01399 · Security Note
• https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/formDMZ.md · Note
• https://t.me/cvedetector/15612 · Telegram Post
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/CVEnew/status/1880625685603205120 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1879984433719099791 · Twitter Post