CVE-2024-9004 Vulnerability Details

  /     /     /  

CVE-2024-9004 Metadata Quick Info

CVE Published: 19/09/2024 | CVE Updated: 20/09/2024 | CVE Year: 2024
Source: VulDB | Vendor: D-Link | Product: DAR-7000
Status : PUBLISHED

CVE-2024-9004 Description

A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Server_commit.php. The manipulation of the argument host leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-78
CWE Name: OS Command Injection
Source: D-Link

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:

Last added CVEs

▸ CVE-2024-9999 ◂
Discovered: 12/11/2024
Status: PUBLISHED
▸ CVE-2024-9997 ◂
Discovered: 29/10/2024
Status: PUBLISHED
▸ CVE-2024-9996 ◂
Discovered: 29/10/2024
Status: PUBLISHED



Tags:
CVE-2024-9004 Vulnerability Details



Fatal error: Uncaught mysqli_sql_exception: Too many connections in /var/www/html/_dbconfig.inc.php:45 Stack trace: #0 /var/www/html/_dbconfig.inc.php(45): mysqli->__construct() #1 /var/www/html/_footer.inc.php(2): require('...') #2 /var/www/html/security/cve/cvedetails.php(270): require('...') #3 {main} thrown in /var/www/html/_dbconfig.inc.php on line 45