CVE-2024-8127

D-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_unzip command injection

State: Published
Severity: 5.3 Medium
Published: Aug 24, 2024
Updated: Aug 26, 2024
Reserved: Aug 23, 2024

Description

A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_unzip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-77 Command Injection

Affected Products

Product	Versions
DNS-120D-Link	20240814Affected
DNR-202LD-Link	20240814Affected
DNS-315LD-Link	20240814Affected
DNS-320D-Link	20240814Affected
DNS-320LD-Link	20240814Affected
DNS-320LWD-Link	20240814Affected
DNS-321D-Link	20240814Affected
DNR-322LD-Link	20240814Affected
DNS-323D-Link	20240814Affected
DNS-325D-Link	20240814Affected
DNS-326D-Link	20240814Affected
DNS-327LD-Link	20240814Affected
DNR-326D-Link	20240814Affected
DNS-340LD-Link	20240814Affected
DNS-343D-Link	20240814Affected
DNS-345D-Link	20240814Affected
DNS-726-4D-Link	20240814Affected
DNS-1100-4D-Link	20240814Affected
DNS-1200-05D-Link	20240814Affected
DNS-1550-04D-Link	20240814Affected

References

VDB-275698 | D-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_unzip command injectionvdb-entrytechnical-description
VDB-275698 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #396236 | D-Link DNS 320/320L/321/323/325/327L Command Injectionthird-party-advisory
https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_unzip.mdexploit
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383related
https://www.dlink.com/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.