Exploit
CVE-2024-8214

Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)

Published: Aug 27, 2024 / Updated: 2mo ago

010
CVSS 5.3EPSS 0.04%Medium
CVE info copied to clipboard

Summary

A critical vulnerability has been discovered in multiple D-Link NAS (Network Attached Storage) devices, specifically affecting the function cgi_FMT_Std2R5_2nd_DiskMGR of the file /cgi-bin/hd_config.cgi. The vulnerability allows for command injection through the manipulation of the argument f_source_dev. This is a remotely exploitable vulnerability that does not require user interaction. The affected devices include various models in the DNS and DNR series, such as DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04, up to the version released on August 14, 2024. It's important to note that this vulnerability only affects products that are no longer supported by the manufacturer and are considered end-of-life.

Impact

The impact of this vulnerability is severe. With a CVSS v3.1 base score of 9.8 (Critical), it poses a significant risk to affected systems. An attacker exploiting this vulnerability could potentially execute arbitrary commands on the target system, leading to complete compromise of the device. This could result in unauthorized access to sensitive data stored on the NAS, modification or deletion of files, and potentially using the compromised device as a foothold for further attacks on the network. The high scores in confidentiality, integrity, and availability impacts (all rated as HIGH) indicate that successful exploitation could lead to a total loss of protection for all resources on the affected system.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

A patch for this vulnerability is available. D-Link has released information about this security issue on their support announcement page. Users can find more details at https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383. However, it's crucial to note that the affected products are end-of-life and no longer supported by D-Link. Therefore, while patch information is available, active support and updates for these devices may be limited or non-existent.

Mitigation

Given that the affected devices are end-of-life and no longer supported, the primary mitigation recommendation is to retire and replace these devices with newer, supported models. If immediate replacement is not feasible, consider the following mitigation strategies: 1. Isolate affected devices: Place the vulnerable NAS devices on a separate, isolated network segment with restricted access. 2. Implement strong access controls: Limit network access to the devices to only necessary users and services. 3. Use a firewall: Configure firewall rules to restrict incoming connections to the affected devices. 4. Monitor for suspicious activity: Implement robust logging and monitoring to detect any potential exploitation attempts. 5. Regularly backup data: Ensure all critical data stored on these devices is backed up to secure, unaffected systems. 6. Disable remote access: If possible, disable remote access features on these devices to reduce the attack surface. 7. Plan for replacement: Develop and implement a plan to replace these end-of-life devices with newer, supported models as soon as possible. Remember, these are temporary measures, and the most effective mitigation is to replace the vulnerable devices with supported, up-to-date alternatives.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-8214. See article

Aug 27, 2024 at 8:03 PM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Aug 27, 2024 at 8:04 PM
CVE Assignment

NVD published the first details for CVE-2024-8214

Aug 27, 2024 at 8:15 PM
CVSS

A CVSS base score of 6.3 has been assigned.

Aug 27, 2024 at 8:20 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.9%)

Aug 28, 2024 at 10:22 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Aug 29, 2024 at 3:45 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Aug 29, 2024 at 5:11 PM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 28, 2024 at 9:24 PM / nvd
Static CVE Timeline Graph

Affected Systems

Dlink/dns-326_firmware
+null more

Exploits

https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_FMT_Std2R5_2nd_DiskMGR.md
+null more

Patches

supportannouncement.us.dlink.com
+null more

Attack Patterns

CAPEC-136: LDAP Injection
+null more

News

Update Fri Sep 27 06:35:53 UTC 2024
Update Fri Sep 27 06:35:53 UTC 2024
US-CERT Vulnerability Summary for the Week of August 26, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
Vulnerability Summary for the Week of August 26, 2024
Vulnerability Summary for the Week of August 26, 2024 bjackson Sep 03, 2024 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info Adobe--Acrobat Reader Acrobat Reader versions 127.0.2651.105 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-08-26 7.8 CVE-2024-41879 psirt@adobe.com aertherwide -- exiftags Buffer Overflow vulnerability in open source exiftags v.1.01 allows a local attacker to execute arbitrary code via the paresetag function. 2024-08-27 7.8 CVE-2024-42851 cve@mitre.org angeljudesuarez -- tailoring_management_system A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file staffcatedit.php. The manipulation of the argument title leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-08-26 9.8 CVE-2024-8171 cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com cna@vuldb.com angeljudesuarez -- tailoring_management_system A vulnerability was found in itsourcecode Tailoring Management System 1.0. It has been declared as critical.
CVE-2024-8214 Exploit
CVE Id : CVE-2024-8214 Published Date: 2024-08-29T15:44:00+00:00 A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. Affected by this vulnerability is the function cgi_FMT_Std2R5_2nd_DiskMGR of the file /cgi-bin/hd_config.cgi. The manipulation of the argument f_source_dev leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE:
CVE-2024-8214
Medium Severity Description A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. Affected by this vulnerability is the function cgi_FMT_Std2R5_2nd_DiskMGR of the file /cgi-bin/hd_config.cgi. The manipulation of the argument f_source_dev leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
See 9 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI