CVE-2024-48633 Command injection in n/a

High 8.0 Published 17 Oct 2024 Updated 17 Oct 2024

Attackers can execute arbitrary OS commands on D-Link routers via crafted POST requests to the virtual server settings function.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-48633?

CVE-2024-48633 is a high-severity command injection vulnerability in n/a, published on 17 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

Weakness: CWE-78

Which versions are affected by CVE-2024-48633?

It affects 2 products.

Products include Dlink Dir-878 Firmware, Dlink Dir-882 Firmware.

How do I fix CVE-2024-48633?

No fix has been published for CVE-2024-48633 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-48633 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-48633 exists.

Sources

Also known as GHSA-22c8-79jr-rvwg.