Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-44410: D-Link DI-8300 Router Firmware Upgrade Exploit Allows Code Execution

CVE-2024-44410 · published 2 years ago

Summary

A weakness in the D-Link DI-8300 router's firmware upgrade process allows an attacker to inject malicious code, potentially taking control of the device. This could allow unauthorized access to the network and its devices. Update to the latest firmware to fix this vulnerability.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dlink	di-8300_firmware	16.07.26a1 `cpe:2.3:o:dlink:di-8300_firmware:16.07.26a1:::::::*`

Original advisory text

D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.

References

https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/CVE-2024-44410 Third Party Advisory
https://github.com/LYaoBoL/IOTsec/blob/main/D-Link/DI-8300A1/DI-8300A1.md Exploit Third Party Advisory
https://www.dlink.com/en/security-bulletin/ Issue Tracking

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

3% chance of attack within 30 days

Type

CWE-77Command Injection

CWE-94Code Injection

Timeline

Published9 Sep 2024

Updated31 Oct 2026

First seen7 Mar 2026

Sources

CVE-2024-44410 · NVD

Track software like this

Free during beta