VulnerabilityAnalyzed
CVE-2024-11046
A vulnerability was found in D-Link DI-8003 16.07.16A1.
MEDIUM 5.3EPSS 4.37%
Does this matter?
Lower severity and a low EPSS score (4.37%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been classified as critical. Affected is the function upgrade_filter_asp of the file /upgrade_filter.asp. The manipulation of the argument path leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CVSS 4.0
- 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 4.37% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77, CWE-78
- Affected
- dlink/di-8003 firmware
- Source
- cna@vuldb.com
References
- https://github.com/theRaz0r/iot-mycve/blob/main/Dlink_DI8003_command_injection/DI8003_command_injection.mdExploit
- https://vuldb.com/?ctiid.283632Permissions Required
- https://vuldb.com/?id.283632Third Party Advisory
- https://vuldb.com/?submit.434929Third Party Advisory
- https://www.dlink.com/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.