CVE-2024-8127

A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_unzip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

• CWE-77
• CWE-78

• https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_unzip.mdExploit, Third Party Advisory
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383Vendor Advisory
• https://vuldb.com/?ctiid.275698Permissions Required, VDB Entry
• https://vuldb.com/?id.275698Permissions Required, VDB Entry
• https://vuldb.com/?submit.396236Third Party Advisory, VDB Entry
• https://www.dlink.com/Product

Published

Aug 24, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8120The ImageRecycle pdf & image compression plugin for WordPres…4.3
• CVE-2024-8121The The Ultimate WordPress Toolkit – WP Extended plugin for …4.3
• CVE-2024-8123The The Ultimate WordPress Toolkit – WP Extended plugin for …5.4
• CVE-2024-8124An issue was discovered in GitLab CE/EE affecting all versio…7.5
• CVE-2024-8125Improper Validation of Specified Type of Input vulnerability…5.4
• CVE-2024-8126The Advanced File Manager plugin for WordPress is vulnerable…8.8
• CVE-2024-8128A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-8129A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-8130A vulnerability has been found in D-Link DNS-120, DNR-202L, …9.8
• CVE-2024-8131A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-3…9.8
• CVE-2024-8132A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-3…9.8
• CVE-2024-8133A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-3…9.8