CVE-2024-8128

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This issue affects the function cgi_add_zip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
D-LinkDNS-12020240814
D-LinkDNR-202L20240814
D-LinkDNS-315L20240814
D-LinkDNS-32020240814
D-LinkDNS-320L20240814
D-LinkDNS-320LW20240814
D-LinkDNS-32120240814
D-LinkDNR-322L20240814
D-LinkDNS-32320240814
D-LinkDNS-32520240814
D-LinkDNS-32620240814
D-LinkDNS-327L20240814
D-LinkDNR-32620240814
D-LinkDNS-340L20240814
D-LinkDNS-34320240814
D-LinkDNS-34520240814
D-LinkDNS-726-420240814
D-LinkDNS-1100-420240814
D-LinkDNS-1200-0520240814
D-LinkDNS-1550-0420240814
dlinkdns-726-4_firmware<= 20240814

References

Timeline

Published
Aug 24, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-81299.8A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DCVE-2024-81309.8A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNSCVE-2024-81319.8A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2024-81329.8A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2024-81339.8A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2024-81349.8A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326,CVE-2024-81359.8A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the fuCVE-2024-81366.1A vulnerability, which was classified as problematic, was found in SourceCodester Record Management System 1.0. This affects an unknown partCVE-2024-81376.1A vulnerability has been found in SourceCodester Record Management System 1.0 and classified as problematic. This vulnerability affects unknCVE-2024-81389.8A vulnerability, which was classified as critical, was found in code-projects Pharmacy Management System 1.0. Affected is the function editMCVE-2024-81399.8A vulnerability has been found in itsourcecode E-Commerce Website 1.0 and classified as critical. Affected by this vulnerability is an unknoCVE-2024-81405.4A vulnerability was found in SourceCodester Task Progress Tracker 1.0 and classified as problematic. Affected by this issue is some unknown