CVE-2024-48632 — OS Command Injection in Dlink Dir-878 Firmware

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.0HIGHNVD

EPSS

0.3%

top 51.32%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-878 Firmware Dlink Dir-882 Firmware

Timeline

PublishedOct 17

Description

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCPPorts, and UDPPorts parameters in the SetPortForwardingSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

▶NVDdlink/dir-878_firmware1.30b08

▶NVDdlink/dir-882_firmware1.30b06

🔴Vulnerability Details

CVEList

CVE-2024-48632: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCP↗2024-10-17

▶

GHSA

GHSA-83rg-r6p3-c2jp: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the LocalIPAddress, TCP↗2024-10-17

▶