Analysis Summary

CVE-2024-44334 CVSS:9.8

D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 could allow a remote attacker to execute arbitrary commands on the system, caused by insufficient parameter filtering in the CGI handling function of upgrade_filter.asp. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2024-44335 CVSS:9.8

D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 could allow a remote attacker to execute arbitrary commands on the system, caused by insufficient filtering of HTTP request parameters in the CGI handling function of version_upgrade_asp-CGI. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2024-44333 CVSS:9.8

D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400G+V2 v24.04.18D1 could allow a remote attacker to execute arbitrary commands on the system. By sending a specially crafted malicious string to the CGI function responsible for handling usb_paswd.asp, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2024-44408 CVSS:7.5

D-Link DIR-823G could allow a remote authenticated attacker to obtain sensitive information. By sending a specially crafted request, a remote attacker could exploit this vulnerability to perform unauthorized configuration file downloads.

CVE-2024-44402 CVSS:9.8

D-Link DI-8100G could allow a remote attacker to execute arbitrary commands on the system, caused by a flaw in msp_info.htm. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2024-44401 CVSS:9.8

D-Link DI-8100G could allow a remote attacker to execute arbitrary commands on the system, caused by a flaw in upgrade_filter.asp. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

Impact

• Code Execution

Indicators of Compromise

CVE

• CVE-2024-44334
• CVE-2024-44335
• CVE-2024-44333
• CVE-2024-44408
• CVE-2024-44402
• CVE-2024-44401

Affected Vendors

Remediation

Refer to D-Link Website for patch, upgrade, or suggested workaround information.

CVE-2024-44334

CVE-2024-44335

CVE-2024-44333

CVE-2024-44408

CVE-2024-44402

CVE-2024-44401