CVE-2024-8129: D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injection
A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. Affected is the function cgis3modify of the file /cgi-bin/s3.cgi of the component HTTP POST Request Handler. The manipulation of the argument fjobname leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8129?
CVE-2024-8129 has been classified as a critical vulnerability.
How do I fix CVE-2024-8129?
To mitigate CVE-2024-8129, users should update their affected D-Link devices to the latest firmware version.
Which D-Link devices are affected by CVE-2024-8129?
CVE-2024-8129 affects multiple D-Link models including DNS-120, DNS-1550-04, and several others listed in the vulnerability details.
What type of vulnerability is CVE-2024-8129?
CVE-2024-8129 is classified as a critical security vulnerability associated with certain D-Link storage devices.
What are the potential impacts of CVE-2024-8129?
The potential impacts of CVE-2024-8129 include unauthorized access and control over affected D-Link devices.