CVE-2024-8132: D-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injection
A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classified as critical. This affects the function webdavmgr of the file /cgi-bin/webdavmgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument fpath leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8132?
CVE-2024-8132 has been classified as a critical vulnerability due to its potential to compromise affected devices.
How do I fix CVE-2024-8132?
To fix CVE-2024-8132, update the firmware on affected D-Link devices to the latest version available.
What devices are affected by CVE-2024-8132?
CVE-2024-8132 affects various models of D-Link devices including DNS-120, DNR-202L, and more.
Is there a workaround for CVE-2024-8132?
Currently, the best workaround for CVE-2024-8132 is to disable remote management on the affected devices until a patch is applied.
When was CVE-2024-8132 disclosed?
CVE-2024-8132 was disclosed in August 2024.