OS Command Injection in D-Link products - CVE-2024-10914
Published: November 11, 2024 / Updated: February 21, 2025
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation when handling data passed via the "name" HTTP GET parameter to account_mgr.cgi script. A remote unauthenticated attacker can send a specially crafted HTTP GET request to the affected device and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
D-Link DNS-325
D-Link DNS-340L
D-Link DNS-320
How to mitigate CVE-2024-10914
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vendor will not fix this vulnerability as the affected device models are no longer supported.
Links to Public Exploits and PoC-codes
- Exploit #11160 - CVE-2024-10914-Exploit (CVE-2024-10914 Shell Exploit) (February 21, 2025)
- Exploit #11020 - CVE-2024-10914 (A PoC exploit for CVE-2024-10914 - D-Link Remote Code Execution (RCE)) (December 27, 2024)
- Exploit #10980 - D-Link (December 13, 2024)
- Exploit #10948 - CVE-2024-10914-Exploit (CVE-2024-10914 is a critical vulnerability affecting the D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L up to version 20241028. The function cgi_user_add in the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add is the culprit, allow (December 6, 2024)
- Exploit #10932 - CVE-2024-10914-EXPLOIT (November 29, 2024)
- Exploit #10897 - CVE-2024-10914 (November 22, 2024)
- Exploit #10855 - CVE-2024-10914 (November 15, 2024)
- Exploit #10853 - Command Injection Vulnerability in name parameter for D-Link NAS (November 11, 2024)