CVE-2024-0921

🗓️ 26 Jan 2024 13:31:04Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

Critical vulnerability in D-Link DIR-816 A2 1.10CNB04, allowing remote os command injection via /goform/setDeviceSettings

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2024-0921	26 Jan 202415:22	–	circl
CNNVD	D-Link DIR-816 A2 OS Command Injection Vulnerability	26 Jan 202400:00	–	cnnvd
Cvelist	CVE-2024-0921 D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection	26 Jan 202413:31	–	cvelist
NVD	CVE-2024-0921	26 Jan 202414:15	–	nvd
OSV	CVE-2024-0921	26 Jan 202414:15	–	osv
Prion	Command injection	26 Jan 202414:15	–	prion
Positive Technologies	PT-2024-1399 · D Link · D-Link Dir-816 A2	26 Jan 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-0921	23 May 202509:32	–	redhatcve
Vulnrichment	CVE-2024-0921 D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection	26 Jan 202413:31	–	vulnrichment

NVD

Node

dlink dir-816_a2_firmwareMatch1.10cnb04

AND

dlink dir-816_a2Match-

[
  {
    "vendor": "D-Link",
    "product": "DIR-816 A2",
    "versions": [
      {
        "version": "1.10CNB04",
        "status": "affected"
      }
    ],
    "modules": [
      "Web Interface"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/xiyuanhuaigu/cve/blob/main/rce.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
statuscheckpppoeuser	request body	/goform/setDeviceSettings	OS command injection via statuscheckpppoeuser parameter in /goform/setDeviceSettings on D-Link DIR-816 A2.	CWE-78

21 Nov 2024 08:47Current

9.8High risk

Vulners AI Score9.8

CVSS 3.14.7 - 9.8

CVSS 25.8

CVSS 34.7

EPSS0.1739

SSVC

CWE-78

cve-2024-0921 d-link dir-816 a2 vulnerability critical remote os command injection web interface