CVE-2024-48636

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.0HIGH

EPSS

0.8%

top 25.58%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-878 Firmware Dlink Dir-882 Firmware

Timeline

PublishedOct 17

Description

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

▶NVDdlink/dir-878_firmware1.30b08

▶NVDdlink/dir-882_firmware1.30b06

🔴Vulnerability Details

CVEList

CVE-2024-48636: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in th↗2024-10-17

▶

GHSA

GHSA-fxj9-2pvv-7wxf: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in th↗2024-10-17

▶