CVE-2024-10914
Published: 06 November 2024
Summary
CVE-2024-10914 is a critical-severity Injection (CWE-74) vulnerability in Dlink Dns-320 Firmware. Its CVSS base score is 9.2 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability identified as CVE-2024-10914 affects D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L devices up to version 20241028. It resides in the cgi_user_add function within /cgi-bin/account_mgr.cgi?cmd=cgi_user_add, where unsanitized input to the name argument permits OS command injection. The flaw is tracked under CWE-74, CWE-78, and CWE-707 and carries a CVSS 4.0 score of 9.2 reflecting high impact on confidentiality, integrity, and availability when successfully exploited.
An unauthenticated remote attacker can trigger the injection by supplying crafted input to the affected CGI endpoint. Although the attack requires high complexity and is considered difficult to exploit in practice, a publicly disclosed proof-of-concept is available that could allow arbitrary command execution on the device.
The provided references include a detailed technical write-up and VulDB entries but do not describe vendor patches or specific mitigation steps from D-Link. The current EPSS score of 0.9361, with a peak of 0.9399, indicates sustained high exploitation probability since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33344
Vulnerability details
A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument name leads to…
more
os command injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Enforces use of documented standards and tool configurations that address proper neutralization of inputs/outputs during development.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.
Validates inputs to block special elements that would alter OS command execution.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.