CVE-2024-0921 — MEDIUM (4.7)

Vulnerability Description

A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the component Web Interface. The manipulation of the argument statuscheckpppoeuser leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252139.

CVSS Score

4.7

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Dlink	Dir-816 A2 Firmware	1.10cnb04
Dlink	Dir-816 A2	-

Related Weaknesses (CWE)

CWE-78

References

https://github.com/xiyuanhuaigu/cve/blob/main/rce.mdExploitThird Party Advisory
https://vuldb.com/?ctiid.252139Permissions RequiredThird Party Advisory
https://vuldb.com/?id.252139Third Party Advisory
https://github.com/xiyuanhuaigu/cve/blob/main/rce.mdExploitThird Party Advisory
https://vuldb.com/?ctiid.252139Permissions RequiredThird Party Advisory
https://vuldb.com/?id.252139Third Party Advisory

FAQ

What is CVE-2024-0921?

CVE-2024-0921 is a vulnerability with a CVSS score of 4.7 (MEDIUM). A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the compon...

How severe is CVE-2024-0921?

CVE-2024-0921 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-0921?

Check the references section above for vendor advisories and patch information. Affected products include: Dlink Dir-816 A2 Firmware, Dlink Dir-816 A2.