CVE-2024-7832

CVE-2024-7832 is a critical buffer overflow vulnerability affecting numerous D-Link DNS and DNR series network-attached storage (NAS) devices, specifically within the cgi_get_fullscreen_photos function of the /cgi-bin/photocenter_mgr.cgi file. This flaw, stemming from improper handling of the 'user' argument, allows for remote code execution. With a CVSS score of 8.8 (High), the vulnerability can be exploited remotely with low attack complexity and requires only low privileges, potentially leading to high impact on confidentiality, integrity, and availability. While the exploit has been publicly disclosed, there is no evidence of active exploitation in the wild, nor are there Metasploit or Nuclei modules available. Community discussion and media coverage for this CVE are minimal, consistent with typical patterns for many vulnerabilities. It is crucial to note that all affected products are end-of-life and unsupported by the vendor, necessitating their immediate retirement and replacement.