Description
D-Link DNS-320等都是中国友讯（D-Link）公司的一款NAS（网络附属存储）设备。 D-Link多款产品存在安全漏洞，该漏洞源于对参数name的错误操作会导致操作系统命令注入。以下产品及版本受到影响：D-Link DNS-320、DNS-320LW、DNS-325和DNS-340L 20241028版本及之前版本。
D-Link多款产品 account_mgr.cgi 任意文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-10914
https://github.com/verylazytech/CVE-2024-10914
https://www.cyfirma.com/research/cve-2024-10914-a-critical-vulnerability-in-d-link-nas-devices/
https://pentest-tools.com/vulnerabilities-exploits/d-link-nas-command-injection-via-name-parameter_23831
https://cvefeed.io/vuln/detail/CVE-2024-10914
https://netsecfish.notion.site/Command-Injection-Vulnerability-in-group-parameter-for-D-Link-NAS-12d6b683e67c803fa1a0c0d236c9a4c5
https://www.ithome.com.tw/news/166015
https://fortiguard.fortinet.com/encyclopedia/ips/56857
https://juejin.cn/post/7618434890031857679