CVE-2024-7833
D-Link DI-8100 upgrade_filter.asp upgrade_filter_asp command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 15, 2024
- Updated
- Sep 3, 2024
- Reserved
- Aug 15, 2024
Description
A vulnerability was found in D-Link DI-8100 16.07. It has been classified as critical. This affects the function upgrade_filter_asp of the file upgrade_filter.asp. The manipulation of the argument path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-77 Command Injection
Affected Products
| Product | Versions |
|---|---|
DI-8100D-Link |
|
References
- VDB-274731 | D-Link DI-8100 upgrade_filter.asp upgrade_filter_asp command injectionvdb-entrytechnical-description
- VDB-274731 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #385338 | D-Link NetworkManager D-LINK DI-8100 16.07 Command Injectionthird-party-advisory
- https://github.com/aLtEr6/pdf/blob/main/3.pdfexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.