CVE-2024-10914

CVE-2024-10914 affects D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. A vulnerable component is cgi_user_add in /cgi-bin/account_mgr.cgi?cmd=cgi_user_add, where improper handling of the name parameter enables OS command injection. Remote exploitation is possible; public PoCs/expl...

CVE-2024-10915

CVE-2024-10915 affects D-Link NAS models DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. The vulnerability is in the function; the group parameter in the endpoint /cgi-bin/account_mgr.cgi?cmd=cgi_user_add can be manipulated to cause an OS command injection, enabling remote code execution...

CVE-2024-10916

CVE-2024-10916 affects D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. The issue resides in the HTTP GET Request Handler’s /xml/info.xml, where an improper handling allows remote information disclosure. Public exploit information exists, enabling remote initiation without user int...