CVE-2024-10914 PoC — D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

Source

https://github.com/K3ysTr0K3R/CVE-2024-10914-EXPLOIT

Associated Vulnerability

Title: D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection (CVE-2024-10914)
Description:A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argument name leads to os command injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

Description

A PoC exploit for CVE-2024-10914 - D-Link Remote Code Execution (RCE)

Readme

# CVE-2024-10914 - D-Link Remote Code Execution (RCE)

This repo contains a proof-of-concept (PoC) exploit for a critical vulnerability affecting D-Link NAS devices. The bug, tracked as **CVE-2024-10914**, impacts the following models:  

- **D-Link DNS-320**  
- **D-Link DNS-320LW**  
- **D-Link DNS-325**  
- **D-Link DNS-340L**  

The vulnerability is in a function called `cgi_user_add`, which is part of the `/cgi-bin/account_mgr.cgi` script.  
The bug happens because the `name` parameter isn't properly checked before it’s used in system commands.  
This lets an attacker send malicious input (OS commands) in the `name` field to execute anything they want on the device.
For example an attacker can send/execute an `id` command through the path of the `name` field `/cgi-bin/account_mgr.cgi?cmd=cgi_user_add&name=%27;id;%27`

# Disclaimer
This PoC is only for testing and learning purposes. I’m not responsible for any illegal or harmful use of this code. Always act responsibly when researching or testing vulnerabilities.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →