CVE-2024-10914criticalexploração observadaCWE-707CWE-74CWE-78

CVE-2024-10914: falha crítica em D-Link DNS-320

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar DNS-320+ Monitorar DNS-340L

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

100Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actcvss 9.2epss 98%
da publicação à arma3 dias
Publicada no NVD6 de nov.
1ª PoC+3d
VulnCheck+7d
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument name leads to os command injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
D-Link · DNS-320D-Link · DNS-320LWD-Link · DNS-325D-Link · DNS-340L
PoCs públicas encontradas — 30
exploitdbwww.exploit-db.com/exploits/52643não verificadogithubgithub.com/verylazytech/CVE-2024-10914★ 48githubgithub.com/imnotcha0s/CVE-2024-10914★ 16githubgithub.com/ThemeHackers/CVE-2024-10914★ 9githubgithub.com/K3ysTr0K3R/CVE-2024-10914-EXPLOIT★ 7githubgithub.com/redspy-sec/D-Link★ 5githubgithub.com/TH-SecForge/CVE-2024-10914★ 1githubgithub.com/Bu0uCat/D-Link-NAS-CVE-2024-10914-★ 1githubgithub.com/yenyangmjaze/cve-2024-10914★ 1githubgithub.com/Tamirido30/CVE-2024-10914-Exploit★ 0githubgithub.com/jahithoque/CVE-2024-10914-Exploit★ 0githubgithub.com/retuci0/cve-2024-10914-port★ 0githubgithub.com/Egi08/CVE-2024-10914★ 0githubgithub.com/0xSS3K/CVE-2024-10914__POC★ 0githubgithub.com/dragonXZH/CVE-2024-10914★ 0vulncheckvulncheck.com/xdb/ad064f09887dnão verificadovulncheckvulncheck.com/xdb/66ae016baa3bnão verificadovulncheckvulncheck.com/xdb/44163f579aebnão verificadocve_referencenetsecfish.notion.site/Command-Injection-Vulnerability-in-name-parameter-for-D-Link-NAS-12d6b683e67c80c49ffcc9214c239a07?pvs=4não verificadovulncheckvulncheck.com/xdb/2eaa329a97ebnão verificadovulncheckvulncheck.com/xdb/ee5eb809e894não verificadovulncheckvulncheck.com/xdb/72c78d52813cnão verificadovulncheckvulncheck.com/xdb/7cf440e61333não verificadovulncheckvulncheck.com/xdb/9ce01a264ae3não verificadovulncheckvulncheck.com/xdb/ce1605f1f68bnão verificadovulncheckvulncheck.com/xdb/5ffb03f6271anão verificadovulncheckvulncheck.com/xdb/111903db432enão verificadovulncheckvulncheck.com/xdb/439b7356b3e8não verificadovulncheckvulncheck.com/xdb/7217a9ad42e7não verificadovulncheckvulncheck.com/xdb/b8db8f5b4ea4não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — D-Link DNS-320

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3273HIGHD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injectionEPSS 100.0%KEVCVE-2024-3272CRITICALD-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentialsEPSS 98.1%KEVCVE-2024-10915CRITICALD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionEPSS 83.2%CVE-2024-3274MEDIUMD-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosureEPSS 33.5%CVE-2024-7715MEDIUMD-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injectionEPSS 26.2%CVE-2024-8132MEDIUMD-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injectionEPSS 24.4%