CVE-2024-8127: D-Link Dnr-202l Firmware

Critical severity, CVSS 9.8. EPSS: 6.7% chance of exploitation in the next 30 days.

A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_unzip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Affected products

  • D-Link Dnr-202l Firmware: affected versions not specified
  • D-Link DNR-322L Firmware: affected versions not specified
  • D-Link Dnr-326 Firmware: affected versions not specified
  • D-Link DNS-1100-4 Firmware: affected versions not specified
  • D-Link DNS-1200-05 Firmware: affected versions not specified
  • D-Link DNS-120 Firmware: affected versions not specified
  • D-Link DNS-1550-04 Firmware: affected versions not specified
  • D-Link DNS-315l Firmware: affected versions not specified
  • D-Link DNS-320 Firmware: affected versions not specified
  • D-Link DNS-320l Firmware: affected versions not specified
  • D-Link DNS-320lw Firmware: affected versions not specified
  • D-Link DNS-321 Firmware: affected versions not specified
  • D-Link DNS-323 Firmware: affected versions not specified
  • D-Link DNS-325 Firmware: affected versions not specified
  • D-Link DNS-326 Firmware: affected versions not specified
  • D-Link DNS-327l Firmware: affected versions not specified
  • D-Link DNS-340l Firmware: affected versions not specified
  • D-Link DNS-343 Firmware: affected versions not specified
  • D-Link DNS-345 Firmware: affected versions not specified
  • D-Link DNS-726-4 Firmware: affected versions not specified

Published 2024-08-24. Last modified 2026-06-17.