CVE-2024-10914 PoC — D-Link多款产品安全漏洞

Source

Associated Vulnerability

Title:D-Link多款产品安全漏洞 (CVE-2024-10914)
Description:D-Link DNS-320等都是中国友讯（D-Link）公司的一款NAS（网络附属存储）设备。 D-Link多款产品存在安全漏洞，该漏洞源于对参数name的错误操作会导致操作系统命令注入。以下产品及版本受到影响：D-Link DNS-320、DNS-320LW、DNS-325和DNS-340L 20241028版本及之前版本。

Description

CVE-2024-10914 D-Link Remote Code Execution (RCE)

Readme

# CVE-2024-10914  D-Link Remote Code Execution (RCE)
<img src=https://github.com/redspy-sec/D-Link/blob/e20a3a8ef405183b9d4d3b5b4225fb8c2cff3fd1/Screenshot_20241207-002840.jpg/>

# D-Link NAS- Command Injection via Name Parameter CVE-2024-10914:- 
A vulnerability was found in D-Link DNS-320, DNS- 320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_ado. The manipulation off the argument name leads to os command injection. 

Dork FOFA: app="D_Link-DNS-ShareCenter"

File Snapshot


 [4.0K]  /data/pocs/7e261f4d694054393918c2083d8801c8c6f2b94b
├── [4.7K]  CVE-2024-10914.py
├── [ 603]  README.md
└── [ 33K]  Screenshot_20241207-002840.jpg

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-10914 PoC — D-Link多款产品 安全漏洞