CVE-2024-48633

8.0 highEPSS 2.1%

D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain multiple command injection vulnerabilities via the ExternalPort, InternalPort, ProtocolNumber, and LocalIPAddress parameters in the SetVirtualServerSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request.

Severity

CVSS 3.1

8.0 high

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2024-10-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dlink:dir-878_firmware
dlink:dir-882_firmware

References

https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_40/40.md
https://www.dlink.com/en/security-bulletin/

Check your stack JSON