CVE-2024-10914

🗓️ 06 Nov 2024 13:31:05Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 218 Views🌐 WEB

Vulnerability in D-Link Network Storage Device

Reporter	Title	Published	Views	Family All 42
GithubExploit	Exploit for Injection in Dlink Dns-320_Firmware	9 Nov 202419:30	–	githubexploit
GithubExploit	Exploit for Injection in Dlink Dns-320_Firmware	13 Dec 202517:55	–	githubexploit
GithubExploit	Exploit for Improper Neutralization in Dlink Dns-320_Firmware	9 Jun 202506:35	–	githubexploit
GithubExploit	Exploit for Improper Neutralization in Dlink Dns-320_Firmware	6 Dec 202419:03	–	githubexploit
GithubExploit	Exploit for Improper Neutralization in Dlink Dns-320_Firmware	15 Nov 202407:56	–	githubexploit
GithubExploit	Exploit for Improper Neutralization in Dlink Dns-320_Firmware	16 Nov 202416:32	–	githubexploit
GithubExploit	Exploit for Improper Neutralization in Dlink Dns-320_Firmware	11 Feb 202520:03	–	githubexploit
GithubExploit	Exploit for Improper Neutralization in Dlink Dns-320_Firmware	4 Dec 202405:27	–	githubexploit
GithubExploit	Exploit for Improper Neutralization in Dlink Dns-320_Firmware	10 Nov 202412:01	–	githubexploit
GithubExploit	Exploit for Improper Neutralization in Dlink Dns-320_Firmware	27 Nov 202423:10	–	githubexploit

NVD

Vulners

Vulnrichment

Node

AND

dlink dns-320_firmware

dlink dns-320Match-

Node

AND

dlink dns-320lw_firmware

dlink dns-320lwMatch-

Node

AND

dlink dns-325_firmware

dlink dns-325Match-

Node

AND

dlink dns-340l_firmware

dlink dns-340lMatch-

[
  {
    "vendor": "D-Link",
    "product": "DNS-320",
    "versions": [
      {
        "version": "20241028",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "D-Link",
    "product": "DNS-320LW",
    "versions": [
      {
        "version": "20241028",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "D-Link",
    "product": "DNS-325",
    "versions": [
      {
        "version": "20241028",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "D-Link",
    "product": "DNS-340L",
    "versions": [
      {
        "version": "20241028",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
netsecfish	www.netsecfish.notion.site/Command-Injection-Vulnerability-in-name-parameter-for-D-Link-NAS-12d6b683e67c80c49ffcc9214c239a07
dlink	www.dlink.com/
vuldb	www.vuldb.com/
bleepingcomputer	www.bleepingcomputer.com/news/security/d-link-wont-fix-critical-flaw-affecting-60-000-older-nas-devices/

Parameter	Position	Path	Description	CWE
name	query param	/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=';{};'	Unauthenticated OS command injection in the cgi_user_add function. The 'name' parameter is concatenated into a system() call without sanitization, allowing remote code execution.	CWE-78, CWE-707, CWE-74