Remote Command Execution Vulnerability in D-Link Devices
CVE-2024-44334

8.8HIGH

Key Information:

Vendor

D-Link
Status
D-Link DI Series Routers
Vendor
CVE Published:
9 September 2024

What is CVE-2024-44334?

D-Link DI series routers suffer from a vulnerability allowing remote command execution. This is due to insufficient parameter filtering in the CGI handling of upgrade_filter.asp. Attackers could exploit this weakness to execute arbitrary commands on affected devices, potentially compromising network security. Users are advised to update their firmware immediately to mitigate this risk.

References

https://www.dlink.com/en/security-bulletin/
https://gist.github.com/Swind1er/563789899a7a4b9c261045a1...

EPSS Score

31% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.