CVE-2024-48638 — OS Command Injection in Dlink Dir-878 Firmware

CWE-78 — OS Command Injection3 documents3 sources

Severity

8.0HIGHNVD

EPSS

0.8%

top 25.55%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dlink Dir-878 Firmware Dlink Dir-882 Firmware

Timeline

PublishedOct 17

Description

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parameter in the SetGuestZoneRouterSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages2 packages

▶NVDdlink/dir-878_firmware1.30b08

▶NVDdlink/dir-882_firmware1.30b06

🔴Vulnerability Details

CVEList

CVE-2024-48638: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parameter in the↗2024-10-17

▶

GHSA

GHSA-f765-974j-wr7x: D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the SubnetMask parameter in the↗2024-10-17

▶