D-Link G416 Flupl Self Command Injection Remote Code Execution Vulnerability

CVE-2024-5295

Summary

The D-Link G416 wireless router is susceptible to a command injection flaw that empowers network-adjacent attackers to execute arbitrary code without authentication. This serious issue stems from inadequate validation of user input by the HTTP service on TCP port 80. By exploiting this vulnerability, attackers can gain root access, potentially compromising the entire network environment. Users are urged to update their firmware to mitigate the risk of exploitation.

References