CVE-2024-5297

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the executeWmicCmd method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21821.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: May 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-529726.5An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/CVE-2024-529736.5An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entr CVE-2024-529746.5An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A succe CVE-2024-529759.0An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INFO and ERROR log leve CVE-2024-529767.8Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitra CVE-2024-529797.5Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead t CVE-2024-52988.8D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote CVE-2024-529806.5A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class co CVE-2024-529817.5An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection o CVE-2024-529827.8Animate versions 23.0.8, 24.0.5 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code e CVE-2024-529837.8Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary c CVE-2024-529847.8Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arb