CVE-2024-4699 is a medium severity deserialization flaw in the D-Link DAR-8000-10, scored 6.3. The device is end of life and D-Link says it will not be fixed. The vendor advice is to retire and replace it, and to keep it off untrusted networks until you do.
What's affected
The record covers D-Link DAR-8000-10 firmware up to 20230922. The flawed file is /importhtml.php, and the sql argument is deserialized unsafely. The weakness is CWE-502. The description is flagged UNSUPPORTED WHEN ASSIGNED, which means the CVE was issued for a product the vendor no longer maintains.
D-Link's support announcement SAP10354 covers the DAR-7000 and DAR-8000 families and lists all models and revisions as end of life or end of service life. Its status line reads Resolved, but the resolution it gives is to retire and replace the device, not a firmware fix. The page lists an end of life date of 12/31/2015 for the DAR-8000.
On severity, NVD scores this 6.3 medium with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, while the VulDB wording in the record calls it critical. Both are in the same record. The KEV flag is false.
How to check if you're exposed
There is no package to scan here. The question is whether the hardware is still in your network.
- Search your asset inventory and procurement records for D-Link DAR-7000 and DAR-8000 units.
- Check network scans for the device's management interface, and see whether it faces the internet.
- Look at the firmware date on the device. The record covers builds up to 20230922, and the vendor says no newer fix exists.
- Ask who still depends on it. These boxes are often forgotten in server rooms.
What to do now
- Remove the management interface from any untrusted network, and take it off the internet first.
- Restrict management access to a small set of admin hosts.
- Use accounts that hold only the access needed, since the vector says low privileges are required.
- Plan a replacement with a supported product and set a date.
- Retire the device securely and wipe its stored configuration.
- Read the D-Link announcement for the current list of affected models.
Why it matters
Deserialization turns stored bytes back into live objects. When the input is attacker controlled, the object graph can trigger behaviour the developer never meant to allow. This is why CWE-502 appears so often in remote code execution reports.
The bigger lesson is operational. A medium score on an unsupported device does not shrink over time. No patch will arrive, and public write ups already exist. Reachability matters most here: a box on an isolated network is a nuisance, and the same box on the internet is a liability. Keeping an inventory with end of life dates lets you act before the next CVE lands on the same hardware.
Quick check
Will D-Link release a patch?
No. The vendor announcement lists the product as end of life and recommends retiring and replacing it.
Sources
- D-Link support announcement SAP10354
- Public write up referenced by the record
- NVD record data for CVE-2024-4699
Last reviewed: 19 October 2026.
