CVE-2024-22651

The vulnerability is located in the ssdpcgi_main function in the cgibin executable file, which is part of the CGI interface of the router software. An attacker can provide crafted input containing malicious system commands, which are then interpreted and executed without proper data validation or sanitization. The attack vector is network-based, requires no authentication or user interaction, making this vulnerability exceptionally dangerous.

An attacker can gain full control over the device, with confidentiality, integrity and availability of the system being completely compromised — arbitrary commands can be executed with CGI process privileges, which may lead to router takeover, network configuration modification or further lateral movement in the network.

Apply patches available from the manufacturer according to the references. In the absence of updates, it is recommended to restrict access to the device's administrative panel exclusively to trusted hosts and disable unnecessary network services available from outside.

D-Link DIR-815 router with software version v1.04