D-Link DIR-846W Vulnerable to Remote Command Execution

CVE-2024-44340

Summary

A remote command execution (RCE) vulnerability exists in the D-Link DIR-846W A1 router due to improper handling of the 'smartqos_express_devices' and 'smartqos_normal_devices' keys in the SetSmartQoSSettings function. This flaw allows an attacker to execute arbitrary commands on the vulnerable device remotely. Exploitation of this vulnerability can lead to unauthorized access and control of the affected router, potentially compromising the entire network. Users are advised to check for updates and apply any necessary patches to mitigate this security risk. For more information, consult D-Link’s security bulletins.

References