First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-24321

CriticalCVSS 9.8/10Last modified Jul 9, 2026

Description

An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dkjiayu/Vul/blob/main/DIR816A2-dir_setWanWifi.mdExploit, Third Party Advisory
https://www.dlink.com/Product
https://www.dlink.com/en/security-bulletin/Product
https://github.com/dkjiayu/Vul/blob/main/DIR816A2-dir_setWanWifi.mdExploit, Third Party Advisory
https://www.dlink.com/Product
https://www.dlink.com/en/security-bulletin/Product

Timeline

Published: Feb 8, 2024
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-243237.2SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consig CVE-2024-243249.8TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.CVE-2024-243259.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParen CVE-2024-243269.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setSt CVE-2024-243279.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIp CVE-2024-243289.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFi CVE-2024-243299.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortF CVE-2024-24332.7An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload f CVE-2024-243309.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the CVE-2024-243319.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiS CVE-2024-243329.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilte CVE-2024-243339.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAcl