Evil-DB LogoEvil-DB
← All CVEs

CVE-2024-10915

critical · 9.2

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument group leads to os command injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

9.2
CVSS
79.6%
EPSS (exploit prob.)
100th
EPSS percentile
2024-11-06
Published

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-78CWE-707

Affected products

VendorProductAffected versions
dlinkdns-320_firmwareall versions
dlinkdns-320all versions
dlinkdns-320lw_firmwareall versions
dlinkdns-320lwall versions
dlinkdns-325_firmwareall versions
dlinkdns-325all versions
dlinkdns-340l_firmwareall versions
dlinkdns-340lall versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-10915