PatchTheCVECVE-2024-9004: A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912
CVE-2024-9004 is a medium-severity flaw (CVSS 6.3) affecting dar-7000 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Server_commit.php. The manipulation of the argument host leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Why this priority
- EPSS top 3%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 16.6% (top 3%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2024-09-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-9004?
dar-7000 firmware: upgrade to newer than 2024-09-12. Exact commands for each OS are on this page.
Is CVE-2024-9004 being exploited?
CVE-2024-9004 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-9004 affect?
CVE-2024-9004 affects dar-7000 firmware. Severity is medium (CVSS 6.3). A vulnerability classified as critical has been found in D-Link DAR-7000 up to 20240912. Affected is an unknown function of the file /view/DBManage/Backup_Server_commit.php. The manipulation of the argument host leads to os command injectio
How urgent is CVE-2024-9004?
Priority 51/100. EPSS top 3%: very likely to be exploited; Public exploit reference
Software pages
PHP vulnerabilities · D-Link vulnerabilities
Related CVEs
- CVE-2025-1800 MEDIUM 6.3 MITIGATE A vulnerability has been found in D-Link DAR-7000 3.2 and classified as critical
- CVE-2024-6525 LOW 2.7 UPGRADE ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000 up to 20230922
- CVE-2024-4965 MEDIUM 6.3 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DAR-7000-40 V31R02B1413C and classified as
- CVE-2024-4964 MEDIUM 6.3 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DAR-7000-40 V31R02B1413C and classifi
- CVE-2024-4963 MEDIUM 6.3 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DAR-700