CVE-2024-4965: D-Link DAR-7000-40 resmanage.php os command injection
First published: Thu May 16 2024(Updated: )
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000-40 V31R02B1413C and classified as critical. This issue affects some unknown processing of the file /useratte/resmanage.php. The manipulation of the argument load leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264533 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| D-Link DAR-7000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://vuldb.com/?id.264533
- https://vuldb.com/?ctiid.264533
- https://vuldb.com/?submit.333784
- https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/%3CWHB%7Cj%5CIbSU0m4%3A_/D-LINK-DAR-7000_RCE_%20resmanage.php.pdf
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10354
Frequently Asked Questions
What is the severity of CVE-2024-4965?
CVE-2024-4965 is classified as a critical vulnerability.
What type of vulnerability is CVE-2024-4965?
CVE-2024-4965 is an OS command injection vulnerability.
How do I fix CVE-2024-4965?
To fix CVE-2024-4965, update your D-Link DAR-7000-40 device to the latest firmware version.
What affects CVE-2024-4965?
CVE-2024-4965 affects the D-Link DAR-7000-40 V31R02B1413C device's handling of the /useratte/resmanage.php file.
Can CVE-2024-4965 be exploited remotely?
Yes, CVE-2024-4965 can be exploited remotely due to the command injection vulnerability.
- agent/weakness
- agent/title
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/d-link
- canonical/d-link dar-7000