CVE-2024-48633 — OS Command Injection in Dlink Dir-878 Firmware

CWE-78 — OS Command Injection3 documents3 sources
Severity
8.0HIGHNVD
EPSS
0.3%
top 51.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Dlink Dir-878 FirmwareDlink Dir-882 Firmware
Timeline
PublishedOct 17

Description

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-22c8-79jr-rvwg: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, Inter↗2024-10-17
▶
CVEList
CVE-2024-48633: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, Inter↗2024-10-17
▶
CVE-2024-48633 — OS Command Injection in Dlink | cvebase