CVE-2024-44333

Vulnerability

Analysis The vulnerability resides in the jhttpd component's handler for the usb_paswd.asp page. The handler does not properly sanitize user-provided input, allowing command injection [1]. Affected models include DI-7003GV2, DI-7100G+V2, DI-7100GV2, DI-7200GV2, DI-7300G+V2, and DI-7400G+V2 running specific firmware versions.

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface. The attack requires network access to the management interface and likely authentication [1]. The provided proof-of-concept demonstrates how to trigger arbitrary command execution.

Impact

Successful exploitation grants the attacker root-level command execution on the device, leading to full compromise, including the ability to modify configurations, exfiltrate data, or use the router in further attacks.

Mitigation

As of publication, no official patch has been released. Users should restrict access to the router's web interface to trusted networks and monitor D-Link's security bulletin for updates [1].