CVE-2024-4960: D-Link DAR-7000-40 licenseauthorization.php unrestricted upload
First published: Thu May 16 2024(Updated: )
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in D-Link DAR-7000-40 V31R02B1413C. Affected is an unknown function of the file interface/sysmanage/licenseauthorization.php. The manipulation of the argument file_upload leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264528. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| D-Link DAR-7000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://vuldb.com/?id.264528
- https://vuldb.com/?ctiid.264528
- https://vuldb.com/?submit.333777
- https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_upload_%20licenseauthorization.php.php.pdf
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
Frequently Asked Questions
What is the severity of CVE-2024-4960?
CVE-2024-4960 has been classified as critical due to the potential for unrestricted file uploads.
How do I fix CVE-2024-4960?
To mitigate CVE-2024-4960, it is recommended to update the D-Link DAR-7000-40 firmware to the latest version.
What is affected by CVE-2024-4960?
CVE-2024-4960 affects the D-Link DAR-7000-40 router, specifically the file interface/sysmanage/licenseauthorization.php.
What type of vulnerability is CVE-2024-4960?
CVE-2024-4960 is an unauthorized file upload vulnerability.
Can CVE-2024-4960 lead to further attacks?
Yes, CVE-2024-4960 can allow attackers to execute arbitrary code on the affected system, leading to potential data breaches.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/d-link
- canonical/d-link dar-7000