CVE-2024-23624

A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dap-1650_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dap-1650:-:*:*:*:*:*:*:*

History

31 Jan 2024, 21:02

Type Values Removed Values Added
CWE CWE-77
References () https://blog.exodusintel.com/2024/01/25/d-link-dap-1650-gena-cgi-subscribe-command-injection-vulnerability/ - () https://blog.exodusintel.com/2024/01/25/d-link-dap-1650-gena-cgi-subscribe-command-injection-vulnerability/ - Third Party Advisory
CPE cpe:2.3:h:dlink:dap-1650:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dap-1650_firmware:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8

26 Jan 2024, 00:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-01-26 00:15

Updated : 2024-02-05 00:22


NVD link : CVE-2024-23624

Mitre link : CVE-2024-23624

CVE.ORG link : CVE-2024-23624


JSON object : View

Products Affected

dlink

  • dap-1650_firmware
  • dap-1650
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')