VulnerabilityAnalyzed

CVE-2024-57684

An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request.

CRITICAL 9.8EPSS 14.4%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 14.4%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 14.36% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-276
Affected: dlink/dir-816 firmware
Source: cve@mitre.org

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/formDMZ.mdBroken Link
https://www.dlink.com/en/security-bulletin/Product

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.