Command Injection Vulnerability in D-Link Routers
CVE-2024-48637

Currently unrated

Key Information:

Vendor

D-Link
Status
Dir-882 Firmware
Vendor
CVE Published:
17 October 2024

What is CVE-2024-48637?

The D-Link DIR-882 and DIR-878 routers are susceptible to a command injection vulnerability through the VLANID:1/VID parameter in the SetVLANSettings function. This security flaw enables an attacker to craft a malicious POST request that exploits the system, potentially allowing for the execution of arbitrary operating system commands. Users are advised to review their configurations and monitor for unusual activities to mitigate the risks associated with this vulnerability.

References

https://www.dlink.com/en/security-bulletin/
https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vul...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.