CVE-2024-8127

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_unzip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
D-LinkDNS-12020240814
D-LinkDNR-202L20240814
D-LinkDNS-315L20240814
D-LinkDNS-32020240814
D-LinkDNS-320L20240814
D-LinkDNS-320LW20240814
D-LinkDNS-32120240814
D-LinkDNR-322L20240814
D-LinkDNS-32320240814
D-LinkDNS-32520240814
D-LinkDNS-32620240814
D-LinkDNS-327L20240814
D-LinkDNR-32620240814
D-LinkDNS-340L20240814
D-LinkDNS-34320240814
D-LinkDNS-34520240814
D-LinkDNS-726-420240814
D-LinkDNS-1100-420240814
D-LinkDNS-1200-0520240814
D-LinkDNS-1550-0420240814
dlinkdns-120_firmware20240814
dlinkdnr-202l_firmware20240814
dlinkdns-315l_firmware20240814
dlinkdns-320_firmware20240814
dlinkdns-320l_firmware20240814
dlinkdns-320lw_firmware20240814
dlinkdns-321_firmware20240814
dlinkdnr-322l_firmware20240814
dlinkdns-323_firmware20240814
dlinkdns-325_firmware20240814
dlinkdns-326_firmware20240814
dlinkdns-340l_firmware20240814
dlinkdns-343_firmware20240814
dlinkdns-345_firmware20240814
dlinkdns-726-4_firmware20240814
dlinkdns-1200-05_firmware20240814
dlinkdns-1550-04_firmware20240814

References

Timeline

Published
Aug 24, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-81289.8A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-3CVE-2024-81299.8A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DCVE-2024-81309.8A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNSCVE-2024-81319.8A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2024-81329.8A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2024-81339.8A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2024-81349.8A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2024-81359.8A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the fuCVE-2024-81366.1A vulnerability, which was classified as problematic, was found in SourceCodester Record Management System 1.0. This affects an unknown partCVE-2024-81376.1A vulnerability has been found in SourceCodester Record Management System 1.0 and classified as problematic. This vulnerability affects unknCVE-2024-81389.8A vulnerability, which was classified as critical, was found in code-projects Pharmacy Management System 1.0. Affected is the function editMCVE-2024-81399.8A vulnerability has been found in itsourcecode E-Commerce Website 1.0 and classified as critical. Affected by this vulnerability is an unkno
CVE-2024-8127: Critical severity, CVSS 9.8 | Vulnix