Cyber Resilience

CVE-2024-9004

MediumPublic PoC

Published: 19 September 2024

Published
19 September 2024
Modified
23 September 2024
KEV Added
—
Patch
—
CVSS Score v4 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.1628 95.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-9004 is a medium-severity OS Command Injection (CWE-78) vulnerability in Dlink Dar-7000 Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2024-9004 is an OS command injection vulnerability, tracked under CWE-78, that affects an unknown function in the file /view/DBManage/Backup_Server_commit.php on D-Link DAR-7000 devices up to firmware version 20240912. Manipulation of the host argument permits injection of operating system commands. The flaw is remotely exploitable and impacts only products that are no longer supported by the vendor.

An authenticated remote attacker with low privileges can supply a crafted host parameter to the affected endpoint, resulting in arbitrary command execution on the device. This grants the ability to read, modify, or disrupt local data and processes without requiring user interaction.

The official D-Link security advisory SAP10354 and related vulnerability disclosures note that the products are end-of-life and receive no further patches, effectively directing users to retire or isolate the hardware.

The exploit code has been made public, and the current EPSS score stands at 0.1628 with no material change from its recorded peak.

EU & UK References

Vulnerability details

A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Server_commit.php. The manipulation of the argument host leads to os command injection. It is possible to launch the…

more

attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection via web endpoint (/view/DBManage/Backup_Server_commit.php) enables exploitation of a public-facing application (T1190) and execution of arbitrary Unix shell commands (T1059.004) on the device.

Affected Assets

dlink
dar-7000 firmware
≤ 2024-09-12

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References