CVE-2024-8127
MEDIUMDescription
A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_unzip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
Is your site exposed to CVE-2024-8127?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| dlink | dns-1550-04_firmware |
| dlink | dns-1550-04 |
| dlink | dns-1200-05_firmware |
| dlink | dns-1200-05 |
| dlink | dns-1100-4_firmware |
| dlink | dns-1100-4 |
| dlink | dns-726-4_firmware |
| dlink | dns-726-4 |
| dlink | dns-345_firmware |
| dlink | dns-345 |
| dlink | dns-343_firmware |
| dlink | dns-343 |
| dlink | dns-340l_firmware |
| dlink | dns-340l |
| dlink | dnr-326_firmware |
| dlink | dnr-326 |
| dlink | dns-327l_firmware |
| dlink | dns-327l |
| dlink | dns-326_firmware |
| dlink | dns-326 |
| dlink | dns-325_firmware |
| dlink | dns-325 |
| dlink | dns-323_firmware |
| dlink | dns-323 |
| dlink | dnr-322l_firmware |
| dlink | dnr-322l |
| dlink | dns-321_firmware |
| dlink | dns-321 |
| dlink | dns-320lw_firmware |
| dlink | dns-320lw |
| dlink | dns-320l_firmware |
| dlink | dns-320l |
| dlink | dns-320_firmware |
| dlink | dns-320 |
| dlink | dns-315l_firmware |
| dlink | dns-315l |
| dlink | dnr-202l_firmware |
| dlink | dnr-202l |
| dlink | dns-120_firmware |
| dlink | dns-120 |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2024-8127? +
How severe is CVE-2024-8127? +
What products are affected by CVE-2024-8127? +
How do I check if I'm vulnerable to CVE-2024-8127? +
Related Vulnerabilities
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments …
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the …
Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command …
Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found …
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management …
A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary …