Log in Start free

Vulnerability · Published Aug 13, 2024 · Assigned by VulDB

CVE-2024-7715D-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injection

Medium 6.3

In plain English

A medium-severity command injection in DNR-202L from D-Link. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 26.2% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)26.2%top 2.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240812. It has been classified as critical. This affects the function sprintf of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument filter leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Affected products (as reported)

VendorProductVersions
D-Link DNS-120 20240812
D-Link DNR-202L 20240812
D-Link DNS-315L 20240812
D-Link DNS-320 20240812
D-Link DNS-320L 20240812
D-Link DNS-320LW 20240812
D-Link DNS-321 20240812
D-Link DNR-322L 20240812
D-Link DNS-323 20240812
D-Link DNS-325 20240812
D-Link DNS-326 20240812
D-Link DNS-327L 20240812
D-Link DNR-326 20240812
D-Link DNS-340L 20240812
D-Link DNS-343 20240812
D-Link DNS-345 20240812
D-Link DNS-726-4 20240812
D-Link DNS-1100-4 20240812
D-Link DNS-1200-05 20240812
D-Link DNS-1550-04 20240812

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References