CVE-2024-48630

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.0HIGH

EPSS

0.3%

top 51.37%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-878 Firmware Dlink Dir-882 Firmware

Timeline

PublishedOct 17

Description

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

▶NVDdlink/dir-878_firmware1.30b08

▶NVDdlink/dir-882_firmware1.30b06

🔴Vulnerability Details

CVEList

CVE-2024-48630: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the↗2024-10-17

▶

GHSA

GHSA-qppf-gxpr-gm52: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the↗2024-10-17

▶