Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-0921

A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the component Web Interface. The manipulation of the argument statuscheckpppoeuser leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252139.

Published

2024-01-26T14:15:50.237

Last Modified

2024-11-21T08:47:44.897

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.7 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: MULTIPLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

6.4

Impact Score

6.4

Weaknesses

Type: Primary
CWE-78

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	dlink	dir-816_a2_firmware	1.10cnb04	Yes
Hardware	dlink	dir-816_a2	-	No

References

https://github.com/xiyuanhuaigu/cve/blob/main/rce.md Exploit, Third Party Advisory ([email protected])
https://vuldb.com/?ctiid.252139 Permissions Required, Third Party Advisory ([email protected])
https://vuldb.com/?id.252139 Third Party Advisory ([email protected])
https://github.com/xiyuanhuaigu/cve/blob/main/rce.md Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://vuldb.com/?ctiid.252139 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://vuldb.com/?id.252139 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)