High severity · published May 23, 2024
CVE-2024-5297
D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability
8.8
CVSS
1.9%
EPSS
No
On KEV
Description
D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the executeWmicCmd method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21821.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DV
D-View · D-Link
2.0.1.28 · source: vendor, CISA
D8
D-view 8 · Dlink
2.0.1.28 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5297
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-448/
More from D-View
9.8
CVE-2024-5296
D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability
9.8
CVE-2023-44414
D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability
9.8
CVE-2023-44411
D-Link D-View InstallApplication Use of Hard-coded Credentials Authentication Bypass Vulnerability
9.8
CVE-2023-32169
D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability
9.8
CVE-2023-32165
D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability