6.9

CVE-2024-13106: d-link dir-816_a2_firmware Incorrect Privilege Assignment

CVSS: 6.9v4.0MediumAnalyzed
Published 02-01-2025Last modified 02-01-2025
Open JSON

Vulnerability summary

CVE-2024-13106 is a medium (CVSS 6.9) Incorrect Privilege Assignment vulnerability in d-link dir-816_a2_firmware. EPSS estimates a 26.00% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
43/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)
EPSS score
26.00%
0%100%
High · -1.20 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Timeline

  1. 02-01-2025
    PublishedVulnerability first disclosed.
  2. 02-01-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/form2IPQoSTcAdd of the component IP QoS Handler. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS metrics

7 scores · 2 sources · 4 versions

EPSS trend

Probability

26.00%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

-1.20 pp

From 27.20% on 19-09-2026

19-09-202619-10-2026
EPSS score
26.00%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Iot Vulnerable

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

D-link1 product
Dlink1 product

2 vendors · 2 products

References

5 links