Command Injection Vulnerability in D-Link DI_8400 Product Line
CVE-2024-44400

9.8CRITICAL

Key Information:

Vendor
D-Link
Status
Di-8400 Firmware
Vendor
CVE Published:
4 September 2024

Summary

A command injection vulnerability has been identified in the D-Link DI_8400 product line, specifically in the upgrade_filter_asp function within the upgrade_filter.asp file. This flaw arises from improper handling of the path parameter, allowing an attacker to manipulate input and execute arbitrary commands on the affected system. Organizations using the D-Link DI_8400 with version 16.07.26A1 are particularly at risk. It's crucial for users to apply the necessary patches and follow security best practices to mitigate potential exploits associated with this vulnerability.

References

https://github.com/lonelylonglong/openfile-/blob/main/D-l...
https://github.com/lonelylonglong/openfile-/blob/main/D-l...

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.