Cyber Resilience

CVE-2024-33343

HighPublic PoC

Published: 26 April 2024

Published
26 April 2024
Modified
21 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0891 92.8th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-33343 is a high-severity OS Command Injection (CWE-78) vulnerability in Dlink Dir-822\+ Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

D-Link DIR-822+ firmware version 1.0.5 contains a command-injection flaw in the ChgSambaUserSettings function of prog.cgi. The issue, tracked as CVE-2024-33343 and assigned CWE-78, permits an unauthenticated attacker to supply crafted input that is passed directly to a system shell, resulting in arbitrary command execution on the device.

An attacker positioned on the adjacent network can reach the affected CGI endpoint without credentials or user interaction. Successful exploitation grants full control over the router, enabling actions that affect confidentiality, integrity, and availability as reflected in the CVSS 8.8 vector.

Public references consist of a D-Link support page for the DIR-822+ and a repository that demonstrates the vulnerable function; neither source supplies mitigation steps or patch availability information. The associated EPSS score has remained flat at 0.0891 with no observed increase after disclosure.

EU & UK References

Vulnerability details

D-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function of prog.cgi, which allows remote attackers to execute arbitrary commands via shell.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

The command injection vulnerability in the web-based CGI script (prog.cgi) enables remote exploitation of a public-facing application (T1190). It facilitates arbitrary shell command execution on the network device/router, aligning with network device CLI abuse (T1059.008).

Affected Assets

dlink
dir-822\+ firmware
1.05

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References