CVE-2024-23625

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-236268.8A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vu CVE-2024-236278.8A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit CVE-2024-236288.8A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploi CVE-2024-236297.5An authentication bypass vulnerability exists in the web component of the Motorola MR2600. An attacker can exploit this vulnerability to acc CVE-2024-23635.3** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability a CVE-2024-236308.8An arbitrary firmware upload vulnerability exists in the Motorola MR2600. An attacker can exploit this vulnerability to achieve code execu CVE-2024-236336.1Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was CVE-2024-236346.0GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming CVE-2024-236356.1AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potentia CVE-2024-236369.8SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian pr CVE-2024-236374.9OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious CVE-2024-236386.5Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Servi