Cyber Resilience

CVE-2024-22852

CriticalPublic PoC

Published: 06 February 2024

Published
06 February 2024
Modified
15 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0564 90.6th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-22852 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Dlink Go-Rt-Ac750 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

D-Link Go-RT-AC750 routers running firmware GORTAC750_A1_FW_v101b03 contain a stack-based buffer overflow in the genacgi_main function. The flaw is tracked as CVE-2024-22852, carries a CVSS 3.1 score of 9.8, and is classified under CWE-787 as an out-of-bounds write that permits remote attackers to enable the telnet service by supplying a crafted payload.

An unauthenticated attacker with network access can send a malicious request that overflows the stack buffer, allowing arbitrary code execution or direct activation of the telnet daemon without any user interaction or credentials. Successful exploitation grants the attacker full control over the device, including the ability to intercept traffic or pivot into the local network.

D-Link has published a security bulletin addressing the issue, although the references do not detail specific patch versions or firmware updates beyond the general advisory link. The EPSS score has remained flat at 0.0564 with no material increase since disclosure.

EU & UK References

Vulnerability details

D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to enable telnet service via a specially crafted payload.

CWE(s)
CWE-787

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

Stack-based buffer overflow in web CGI (genacgi_main) enables exploitation of public-facing application (T1190) and remote service (T1210). Specifically allows enabling telnet service, facilitating Network Device CLI access (T1059.008).

Affected Assets

dlink
go-rt-ac750 firmware
101b03

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-16 Memory Protection
addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

References