ExploitCVE-2024-8134
Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Summary
A critical vulnerability has been identified in multiple D-Link Network Attached Storage (NAS) devices. The vulnerability affects the function cgi_FMT_Std2R5_1st_DiskMGR of the file /cgi-bin/hd_config.cgi, which is part of the HTTP POST Request Handler. The issue allows for command injection through the manipulation of the argument f_source_dev. This vulnerability can be exploited remotely and requires no user interaction or privileges. The affected devices include D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 up to firmware version 20240814.
Impact
The impact of this vulnerability is severe. An attacker exploiting this vulnerability could gain unauthorized access to the affected D-Link NAS devices, potentially allowing them to execute arbitrary commands with the highest privileges. This could lead to complete system compromise, including unauthorized data access, modification, or deletion, as well as using the compromised device as a foothold for further network intrusion. The CVSS v3.1 base score of 9.8 (Critical) indicates maximum impact on confidentiality, integrity, and availability of the affected systems. Given the nature of NAS devices, which often store sensitive and critical data, the potential for data theft or corruption is particularly concerning.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available for this vulnerability. D-Link has released security advisory SAP10383, which can be found at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383. However, it's crucial to note that this vulnerability affects products that are no longer supported by the maintainer. D-Link has confirmed that the affected products are end-of-life, and the vendor recommends that these devices should be retired and replaced. This means that while a patch exists, it may not be applicable or advisable to apply to these outdated devices.
Mitigation
Given that the affected devices are end-of-life and no longer supported, the primary mitigation strategy is to replace these devices with newer, supported models. If immediate replacement is not feasible, consider the following interim measures: 1. Isolate affected devices from the internet and restrict network access to trusted IP addresses only. 2. Implement strong network segmentation to limit the potential impact of a compromise. 3. Monitor these devices closely for any signs of suspicious activity. 4. Regularly backup any critical data stored on these devices. 5. Plan for the immediate replacement of these devices with current, supported models that receive regular security updates. It's crucial to emphasize that these mitigation steps are temporary and that the only long-term solution is to replace the vulnerable devices. Prioritize the replacement of these devices based on their criticality and exposure in your network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Timeline
Feedly found the first article mentioning CVE-2024-8134. See article
Feedly estimated the CVSS score as HIGH
The vulnerability CVE-2024-8134 affects the WordPress Favicon Generator plugin, with a CVSS score of 9.6, making it critical. It allows for remote command injection, potentially leading to unauthorized access or data manipulation. Users should update to the latest version of the plugin to mitigate the risk of exploitation. See article
A CVSS base score of 9.8 has been assigned.