CVE-2024-4962 is a medium severity (CVSS 6.3) unrestricted file upload in the D-Link DAR-7000-40, through the file /useratte/resmanage.php. The product is end-of-life and no fix will ship. D-Link's advice is to retire and replace the device, and to keep its admin interface off untrusted networks until then.
What's affected
D-Link DAR-7000-40 firmware V31R02B1413C, the version named in the record, along with the DAR-7000 hardware entry. The vulnerable component is /useratte/resmanage.php, and the manipulated argument is named file. The record says the attack can be launched remotely and that an exploit has been disclosed to the public.
The record carries an unsupported-when-assigned notice. It says the product is end-of-life and that the vendor, once contacted, confirmed this straight away and said the device should be retired and replaced. There is no fixed version to move to.
The sources differ on severity. The description, taken from VulDB, calls the issue critical. The NVD CVSS score is 6.3, which is Medium. Both are published, and neither changes the advice.
The weakness class is CWE-434, unrestricted upload of file with dangerous type. The record scores it 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
Start by working out whether you own one. DAR-7000 is a business-class appliance, and the record is specific to the DAR-7000-40 build named above. Check asset inventories and network scans for D-Link management interfaces, and check the firmware string in the device's admin page against V31R02B1413C.
The D-Link announcement SAP10354 covers the DAR-7000 and lists fixed firmware as not available. The page text I retrieved referred to other CVE identifiers than this one, so confirm directly with D-Link or your regional office that the advisory covers this CVE for your hardware revision.
If the admin interface is reachable from outside your management network, treat that as the urgent finding, whatever the firmware says.
What to do now
- Find every DAR-7000 in your estate, including units kept as spares or in branch offices.
- Remove the admin interface from any untrusted network today. Allow it only from a dedicated management segment.
- Plan the replacement. Follow D-Link's retire and replace guidance rather than waiting for firmware that the vendor says is not available.
- Review the device and any upstream logs for unexpected files or unusual requests to /useratte/resmanage.php.
- Keep the last known firmware and use unique admin credentials until the unit is gone, as D-Link advises for units that must stay briefly.
Why it matters
An upload handler that accepts files without checking their type is a classic way to place content on a server that the server then treats as something it should run or serve. That is the weakness class here. The record does not describe what an attacker could do after uploading, and this post will not guess.
The larger lesson is about lifecycle. When a vendor confirms a product is end-of-life, a CVE stops being a patching task and becomes a replacement project. Someone has to own that project, with a date. An inventory that records support status next to each device is what makes that visible. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, according to the record.
Quick check
Is there a firmware update for CVE-2024-4962?
No. The record says the product is end-of-life, and the D-Link announcement lists fixed firmware as not available. The vendor recommends retiring the device.
Is it exploited in the wild?
The record does not flag it as a CISA KEV entry, and I did not find an advisory stating exploitation. It does say an exploit was disclosed publicly, which lowers the bar for attackers.
Sources
- D-Link security announcement SAP10354
- VulDB entry
- Researcher write-up PDF linked from the NVD record (listed there, not fetched for this review).
Last reviewed: 19 October 2026.
