CVE-2024-0921: D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 37.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-26 · updated 2026-06-17
Weakness: CWE-78

Description

A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/setDeviceSettings of the component Web Interface. The manipulation of the argument statuscheckpppoeuser leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252139.

Affected products

Dlink Dir-816 A2 Firmware: 1.10cnb04

References

https://github.com/xiyuanhuaigu/cve/blob/main/rce.md
https://vuldb.com/?ctiid.252139
https://vuldb.com/?id.252139
https://github.com/xiyuanhuaigu/cve/blob/main/rce.md
https://vuldb.com/?ctiid.252139
https://vuldb.com/?id.252139

Get alerted when CVE-2024-0921 or the next vulnerability affects your stack