D-Link DNS Devices at Risk of Command Injection Vulnerability

CVE-2024-8128

What is CVE-2024-8128?

A vulnerability has been discovered in several D-Link network attached storage devices, specifically affecting the cgi_add_zip function in the /cgi-bin/webfile_mgr.cgi file. This issue arises from improper handling of the 'path' argument, allowing attackers to perform command injection. The vulnerability is accessible remotely, enabling malicious actors to execute arbitrary commands on the affected devices. The flaw impacts devices that are no longer supported, and users are advised to retire and replace these products to safeguard their networks. Full details regarding the exploitation of this vulnerability can be found in the publicly disclosed resources.

References