CVE-2024-57684
Published: 16 January 2025
Summary
CVE-2024-57684 is a critical-severity Incorrect Default Permissions (CWE-276) vulnerability in Dlink Dir-816 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to system resources like the formDMZ.cgi endpoint, preventing unauthenticated attackers from configuring DMZ services.
Applies least privilege to restrict DMZ configuration changes to only authorized users or processes, blocking unauthenticated exploitation.
Limits permitted actions without identification or authentication to non-sensitive functions, ensuring DMZ service configuration requires authentication.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public-facing web management interface (formDMZ.cgi) on network device.
NVD Description
An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request.
Deeper analysisAI
CVE-2024-57684 is an access control vulnerability (CWE-276) affecting the formDMZ.cgi component in D-Link DIR-816A2 firmware version 1.10CNB05_R1B011D88210. Published on January 16, 2025, it enables unauthenticated attackers to configure the device's DMZ service by sending a crafted POST request. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impacts across confidentiality, integrity, and availability.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction. By targeting the formDMZ.cgi endpoint, they can arbitrarily set the DMZ service configuration, granting them unauthorized control over the router's exposure settings.
Advisories and mitigation guidance are available via the vendor's security bulletin at https://www.dlink.com/en/security-bulletin/ and a detailed disclosure including proof-of-concept at https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/formDMZ.md. Security practitioners should consult these resources for patching instructions or workarounds specific to affected D-Link DIR-816A2 devices.
Details
- CWE(s)