CVE-2024-10914

Think of this device’s account-management page like a door with a “create user” button. Because of a flaw, a skilled attacker might be able to trick that button into running system commands on the device instead of only creating a user. If they can reach the door from the network, the attacker could potentially take control of the device and disrupt service or access stored files.

This matters if you use D-Link DNS-320, DNS-320LW, DNS-325, or DNS-340L (including their firmware) for storing or serving business files and you expose the web management/account features to other networks. The risk is remote, meaning the attack can be launched over the network, but the exploit difficulty is described as high. Only treat it as an immediate risk if the device’s management interface is reachable from the internet (for example through port forwarding or remote access).

This is RED because the vulnerability has received sustained security attention and the public disclosure means attackers can act on it. While exploitation may be described as difficult, the impact (command injection leading to device compromise) is severe enough that you should treat it as urgent and patch/restrict access immediately.

1. Confirm exposure (quick checks)

   • Identify the exact model: DNS-320, DNS-320LW, DNS-325, or DNS-340L.
   • Check the device firmware version and confirm whether it is within the vulnerable scope “up to 20241028.”
   • Determine whether the device’s management interface is reachable externally: review whether you have internet-facing access such as port forwarding, UPnP, or remote admin features.

2. Immediate containment (if externally reachable)

   • Remove port forwarding rules to the device’s web/admin interface.
   • If you need remote access, switch to a safer method (for example, access via a VPN) so the web interface is not directly reachable from the public internet.

3. Patch with the vendor’s firmware

   • Download the firmware update for your exact model from a trusted source.
   • Install the update so your firmware is no longer in the vulnerable window (i.e., later than the fix point 20241028).
   • Reboot the device if the update process requires it.

4. Post-update verification

   • Re-check that remote reachability is still restricted (no accidental port forwards).
   • Review the device’s logs for unusual account/user creation activity—since the vulnerable functionality is account-related (cgi_user_add).

5. If you can’t patch right away

   • Keep the device management interface non-internet-reachable (remove port forwarding / gate via VPN) until the firmware update can be applied.
   • Avoid making administrative changes from untrusted networks.

6. What to monitor

   • Alerts for unexpected user/account changes.
   • Signs of repeated access attempts to the account-management endpoint.
   • Overall device stability (unexpected reboots or service interruptions).

Severity is high (CVSS 8.1 provided) with a weakness tied to command injection (CWE-74), improper input handling (CWE-78), and a command execution flow (CWE-707). The affected code path is account-management functionality: /cgi-bin/account_mgr.cgi with cmd=cgi_user_add; manipulation of request parameters can result in OS command injection. The attack is described as remotely launchable, though exploitation is characterized as difficult and the weaponization/exploit evidence is limited to detection templates (no KEV listing in CISA KEV and no explicit dated “in-the-wild” confirmation in the provided findings). KEV is not listed for this CVE, so KEV-based confirmation is absent. Public disclosure and sustained press attention increase the practical likelihood that attackers will attempt scanning/exploitation. EPSS provides a prediction (96.3%, flat trend), but it is not a substitute for confirmation; no KEV/news override was provided here. The fix guidance in the findings emphasizes installing vendor updates from trusted sources; specific fixed versions are not included in the provided data.