Read the docs
TI-2024-07274 Aliases CVE-2024-7849GHSA-qh37-c5wh-h2f2

D-Link DNS-1550-04 photocenter_mgr.cgi cgi_create_album buffer overflow

Priority HIGH 73CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This affects the function cgi_create_album of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument current_path leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0117 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
D-LinkDNS-12020240814—No fix listedCNA
D-LinkDNR-202L20240814—No fix listedCNA
D-LinkDNS-315L20240814—No fix listedCNA
D-LinkDNS-32020240814—No fix listedCNA
D-LinkDNS-320L20240814—No fix listedCNA
D-LinkDNS-320LW20240814—No fix listedCNA
D-LinkDNS-32120240814—No fix listedCNA
D-LinkDNR-322L20240814—No fix listedCNA
D-LinkDNS-32320240814—No fix listedCNA
D-LinkDNS-32520240814—No fix listedCNA
D-LinkDNS-32620240814—No fix listedCNA
D-LinkDNS-327L20240814—No fix listedCNA
D-LinkDNR-32620240814—No fix listedCNA
D-LinkDNS-340L20240814—No fix listedCNA
D-LinkDNS-34320240814—No fix listedCNA
D-LinkDNS-34520240814—No fix listedCNA
D-LinkDNS-726-420240814—No fix listedCNA
D-LinkDNS-1100-420240814—No fix listedCNA
D-LinkDNS-1200-0520240814—No fix listedCNA
D-LinkDNS-1550-0420240814—No fix listedCNA
  • DNS-120 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNR-202L VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-315L VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-320 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-320L VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-320LW VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-321 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNR-322L VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-323 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-325 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-326 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-327L VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNR-326 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-340L VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-343 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-345 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-726-4 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-1100-4 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-1200-05 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA
  • DNS-1550-04 VendorD-Link Affected 20240814 Fixed in — No fix listed CNA

CPE names CISA-ADP · 20

CPEVersionsRoleVendor
cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dnr-322l_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
  • cpe:2.3:o:dlink:dnr-202l_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dnr-322l_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dnr-326_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-1100-4_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-1200-05_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-120_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-1550-04_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-315l_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-320l_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:*——D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-321_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-323_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-326_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-327l_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-343_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-345_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.
  • cpe:2.3:o:dlink:dns-726-4_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7849
  2. 2026-10-03 Alias added: GHSA-qh37-c5wh-h2f2

References

Exploit 1

Other 1

  • TI-2024-03070 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-03069 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-00708 D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-10693 OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-17249 D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09657 D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE)… KEVCVSS 3.1CRITICAL 9.8
See all 979 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences