CVE-2024-4961: D-Link DAR-7000-40 onlineuser.php unrestricted upload

Published May 16, 2024

Updated

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DAR-7000-40 V31R02B1413C. Affected by this vulnerability is an unknown functionality of the file /user/onlineuser.php. The manipulation of the argument fileupload leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264529 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.

Affected Software

3 affected components

D-Link DAR-7000-40

All of the following

Dlink Dar-7000 Firmware=v31r02b1413c

Dlink Dar-7000

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove D-Link DAR-7000-40 from your environment.
Retire the end-of-life D-Link DAR-7000-40 and replace it with a supported product (the vulnerability affects /user/onlineuser.php via unrestricted upload).
Compensating control
Since the attack can be launched remotely and exploits the file_upload argument in /user/onlineuser.php, restrict external/network access to the affected device endpoint so remote users cannot reach the vulnerable upload functionality.

Event History

May 16, 2024

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-4961?

CVE-2024-4961 is classified as a critical vulnerability.

What is the impact of exploiting CVE-2024-4961?

Exploiting CVE-2024-4961 allows for unrestricted file uploads through the /user/onlineuser.php functionality.

How do I fix CVE-2024-4961?

To fix CVE-2024-4961, ensure that proper validation mechanisms for file uploads are implemented on the affected device.

Which devices are affected by CVE-2024-4961?

CVE-2024-4961 affects the D-Link DAR-7000-40 router on firmware version V31R02B1413C.

Is there any public exploit available for CVE-2024-4961?

Yes, there are public exploits available for CVE-2024-4961, which demonstrate the vulnerability of unrestricted uploads.