CVE-2024-48636: Command Injection
Published Oct 17, 2024
·Updated
D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the VLANID:0/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.
Affected Software
6 affected components
D-Link DIR-882
D-Link DIR-878
All of the following
Dlink Dir-882 Firmware=1.30b06
Dlink Dir-882
All of the following
Dlink Dir-878 Firmware=1.30b08
Dlink Dir-878
Event History
Oct 17, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-48636?
CVE-2024-48636 is classified as a high-severity command injection vulnerability.
2
How do I fix CVE-2024-48636?
To fix CVE-2024-48636, update the firmware of your D-Link DIR-882 or DIR-878 router to the latest version provided by the manufacturer.
3
What devices are affected by CVE-2024-48636?
CVE-2024-48636 affects the D-Link DIR-882 and DIR-878 routers.
4
What can attackers do with CVE-2024-48636?
Attackers can execute arbitrary OS commands on affected devices via a crafted POST request due to CVE-2024-48636.
5
Is CVE-2024-48636 remote or local exploit?
CVE-2024-48636 can be exploited remotely by sending a malicious POST request.