CVE-2024-33344

Deeper analysis

D-Link DIR-822+ firmware version 1.0.5 contains a command injection vulnerability in the ftext function of upload_firmware.cgi. The flaw, tracked as CVE-2024-33344 and assigned CWE-77, permits unauthenticated remote attackers to supply crafted input that is passed directly to a system shell, resulting in arbitrary command execution. The issue carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker with network access to the device can send a malicious HTTP request to the firmware upload endpoint and obtain full control of the router, including the ability to read or modify configuration, install persistent malware, or pivot to other hosts on the LAN. No authentication or special privileges are needed, making the exposure particularly severe for internet-facing or locally reachable devices.

The associated EPSS score has reached 0.5369 without a documented rise from a lower baseline. Public references consist of a D-Link support page for the affected model and a GitHub repository containing proof-of-concept details; no vendor advisory describing patches or mitigation steps is provided in the available references.