CVE-2024-48634: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the…

PriorityP262high8CVSS 3.1

AVAACLPRLUINSUCHIHAH

EPSS

16.71%

96.7th percentile

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in the SetWLanRadioSecurity function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
dlink	dir-878_firmware	—	—
dlink	dir-882_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/HNAP1

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSecurity Key Parameter Command Injection Attempt (CVE-2024-48634)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:6; content:"/HNAP1"; http.request_body; content:"|3c 3f|xml|20|version|3d 22|1.0|22|"; content:"|3c|SetWLanRadioSecurity"; fast_pattern; content:"|3c|Key|3e|"; pcre:"/^[^\x3e]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:cve,2024-48634; classtype:attempted-admin; sid:2065142; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_10_10, cve CVE_2024_48634, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

bytes

|3c 3f|xml|20|version|3d 22|1.0|22|

bytes

|3c|SetWLanRadioSecurity

bytes

|3c|Key|3e|

→Exploit traffic is plaintext HTTP (not TLS); deploy detection at the network perimeter and internally on HTTP traffic only.
→Attack arrives as an HTTP POST request to the exact URI /HNAP1 (bsize:6 — no trailing path), targeting D-Link DIR_882 and DIR_878 routers.
→The POST body contains a SOAP/XML envelope invoking SetWLanRadioSecurity; the injection payload is embedded inside the <Key> XML element.
→Command injection characters to look for inside the Key parameter value (URL-encoded or raw): semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), and dollar sign ($/%24).
→MITRE mapping: TA0001 Initial Access / T1190 Exploit Public-Facing Application — treat successful hits as potential initial access events requiring immediate triage.

·Affected firmware versions are DIR_882_FW130B06 and DIR_878_FW130B08; ensure detection scope is limited to or prioritised against hosts running these specific firmware builds. ↗
·The Snort/Suricata rule (SID 2065142) targets dest_ip, meaning it fires on the destination (router) side; confirm $HOME_NET includes your D-Link management subnets for accurate coverage.

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.