CVE-2024-40505

The vulnerability exists in the hedwig.cgi component of the D-Link DAP-1650 device. An attacker with local access to the device can exploit improper file path handling (CWE-35 — path traversal) to escape the allowed directory and gain access to system resources outside the intended scope. As a result, privilege escalation to a higher privilege level is possible.

An attacker can gain elevated privileges on the device, which consequently may lead to complete takeover of the router, including configuration modification, network traffic interception, or further lateral movement in the network.

Security patches available from the manufacturer should be applied in accordance with the references (D-Link security announcement SAP10266 available at supportannouncement.us.dlink.com). It is recommended to update the device firmware to a vulnerability-free version as soon as possible.

D-Link DAP-1650 with firmware version 1.03