CVE-2024-39962

The vulnerability exists in the ntp_zone_val parameter handled by the /goform/set_ntp endpoint. The attacker sends a crafted HTTP request containing a malicious payload in this parameter, which leads to execution of arbitrary code on the device. The vulnerability is classified as CWE-94 (Improper Control of Code Generation) and indicates a lack of proper validation and sanitization of input data before processing.

An unauthorized attacker can remotely, without any authentication, execute arbitrary code on the device with the privilege level of the process handling the request — which in practice means complete takeover of the router, ability to modify network configuration, and potential use of the device as an entry point to the local network.

Patches available from the manufacturer should be applied according to the references. Until updates are applied, it is recommended to restrict access to the router's administrative panel only to trusted hosts and disable remote management of the device from the WAN network side.

D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router with firmware version v21_D240126