CVE-2024-10914

CVE-2024-10914 在 D-Link DNS-320、DNS-320LW、DNS-325 和 DNS-340L（截至 20241028）中发现了一个漏洞。该漏洞被评定为严重。受影响的是文件 /cgi-bin/accountmgr.cgi?cmd=cgiuseradd 中的函数 cgiuseradd。通过操纵参数 name 可导致操作系统命令注入。攻击可远程发起。攻击复杂度较高，利用难度较大。该漏洞利用方法已公开，可能被使用。 受影响设备 DNS-320 版本 1.00 DNS-320LW 版本 1.01.0914.2012 DNS-325 版本 1.01, 版本 1.02...

D-Link-NAS-CVE-2024-10914-

D-Link-NAS-CVE-2024-10914- 这是一个D-Link rce漏洞 检测程序 漏洞简介 D-Link DNS-320等都是中国友讯（D-Link）公司的一款NAS（网络附属存储）设备。 D-Link多款产品存在安全漏洞，该漏洞源于对参数name的错误操作会导致操作系统命令注入。以下产品及版本受到影响：D-Link DNS-320、DNS-320LW、DNS-325和DNS-340L 20241028版本及之前版本 网络测绘 app="DLink-DNS-ShareCenter"...

CVE-2024-10914

cve-2024-10914 cve-2024-10914 的漏洞利用程序：D-Link DNS-320、DNS-320LW、DNS-325、DNS-340L 版本 1.00、版本 1.01.0914.2012、版本 1.01、版本 1.02、版本 1.08 命令注入...

CVE-2024-10914-Exploit

CVE-2024-10914-Exploit CVE-2024-10914は、D-Link DNS-320、DNS-320LW、DNS-325、DNS-340L（バージョン20241028まで）に影響する重大な脆弱性です。ファイル/cgi-bin/accountmgr.cgi?cmd=cgiuseradd内の関数cgiuseraddが原因であり、攻撃者がリモートからオペレーティングシステムコマンドを注入することを可能にします。 スクリプトの使用方法: './cve-2024-10914-exploit.sh -u -c '...

D-Link NAS - Command Injection via Group Parameter

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgiuseradd of the file /cgi-bin/accountmgr.cgi?cmd=cgiuseradd. The manipulation of the argument group leads to os command injection. i...

D-Link DNS-320 - Remote Code Execution

The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. id: CVE-2019-16057 info: name: D-Link DNS-320 - Remote Code Execution author: DhiyaneshDk severity: critical description: | The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerabl...

CVE-2024-10914-EXPLOIT

CVE-2024-10914 - D-Link 远程代码执行 RCE 本仓库包含针对影响D-Link NAS设备的关键漏洞的概念验证（PoC）利用代码。该漏洞编号为 CVE-2024-10914 ，影响以下型号： D-Link DNS-320 D-Link DNS-320LW D-Link DNS-325 D-Link DNS-340L 该漏洞位于名为 cgiuseradd 的函数中，该函数属于 /cgi-bin/accountmgr.cgi 脚本。 漏洞产生的原因是 name 参数在被用于系统命令之前没有经过适当的检查。 这使得攻击者可以在 name...

EUVD-2026-70768

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224 D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...

CVE-2026-85224

CVE-2026-85224 is an OS command injection vulnerability in the File Sharing component of D-Link DNS-320 ShareCenter (firmware 2.06B01), specifically in /cgi/file_sharing.cgi. Manipulation of the fileurl argument allows a remote attacker to execute arbitrary commands. The CVSS 3.1 score is 9.1 (CR...

CVE-2026-16447

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multiuploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

EUVD-2026-46258

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multiuploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

CVE-2026-16447 D-Link DNS-320 multi_uploadify.php unrestricted upload

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multiuploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

CVE-2026-16447

CVE-2026-16447 concerns a vulnerability in the D-Link DNS-320 1.0.2 where the argument Filedata[] in /web/jquery/uploader/multi_uploadify.php can be manipulated to achieve unrestricted upload. Remote exploitation is possible according to the provided records. The affected component is a server-si...

CVE-2026-16332

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multiuploadify.php. Performing a manipulation of the argument Filedata results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may b...

EUVD-2026-46143

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multiuploadify.php. Performing a manipulation of the argument Filedata results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may b...

CVE-2026-16332

CVE-2026-16332 affects D-Link DNS-320 with firmware 1.0.2. The vulnerability resides in the file /mydlink/multi_uploadify.php; manipulating the argument Filedata[] enables unrestricted upload. This can be exploited remotely, and the exploit is public and may be used. The connected documents provi...

CVE-2026-16332

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multiuploadify.php. Performing a manipulation of the argument Filedata results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may b...

CVE-2026-16332 D-Link DNS-320 multi_uploadify.php unrestricted upload

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multiuploadify.php. Performing a manipulation of the argument Filedata results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may b...