Remote Command Execution Vulnerability Discovered in D-Link DIR-823X Firmware
CVE-2024-39202

8.8HIGH

Key Information:

Vendor
D-Link
Status
Dir-823x Ax3000 Firmware
Vendor
CVE Published:
8 July 2024

Summary

A significant remote command execution vulnerability exists in the D-Link DIR-823X firmware version 240126. This vulnerability is triggered via the 'dhcpd_startip' parameter when navigating to the /goform/set_lan_settings endpoint. An attacker with access to the device can exploit this flaw to execute arbitrary commands remotely, potentially compromising the device and surrounding network security.

References

https://gist.github.com/Swind1er/40c33f1b1549028677cb4e2e...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.