D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability
CVE-2024-5291

8.8HIGH

Key Information:

Vendor

D-link
Status
Dir-2150
Vendor
CVE Published:
23 May 2024

What is CVE-2024-5291?

The D-Link DIR-2150 routers are susceptible to a remote code execution vulnerability that enables attackers, positioned on the same network, to execute arbitrary commands. The flaw lies within the SOAP API interface found on TCP port 80, where user-supplied input is inadequately validated prior to executing system calls. This security oversight permits an unauthenticated attacker to gain control in the context of the root user, posing significant risks to device integrity and network security. For further details, refer to the advisory linked here: ZDI-24-442.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

DIR-2150 1.06B01

References

https://www.zerodayinitiative.com/advisories/ZDI-24-442/
x_research-advisory

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.