CVE-2024-4963 is a medium severity (CVSS 6.3) unrestricted upload in the D-Link DAR-7000-40, reached through /url/url.php and its file_upload argument. The device is end-of-life with no patch available. Replace it, and until then keep its management interface off untrusted networks.
What's affected
D-Link DAR-7000-40 firmware V31R02B1413C, the version named in the record, along with the DAR-7000 hardware entry. This entry concerns a different page from its siblings: /url/url.php, where the file_upload argument is the one manipulated. The record says remote initiation is possible and a public exploit exists.
The record carries an unsupported-when-assigned notice. It says the product is end-of-life and that the vendor, once contacted, confirmed this straight away and said the device should be retired and replaced. There is no fixed version to move to.
The sources differ on severity. The description, taken from VulDB, calls the issue critical. The NVD CVSS score is 6.3, which is Medium. Both are published, and neither changes the advice.
The weakness class is CWE-434, unrestricted upload of file with dangerous type. The record scores it 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
Start by working out whether you own one. DAR-7000 is a business-class appliance, and the record is specific to the DAR-7000-40 build named above. Check asset inventories and network scans for D-Link management interfaces, and check the firmware string in the device's admin page against V31R02B1413C.
The D-Link announcement SAP10354 covers the DAR-7000 and lists fixed firmware as not available. The page text I retrieved referred to other CVE identifiers than this one, so confirm directly with D-Link or your regional office that the advisory covers this CVE for your hardware revision.
If the admin interface is reachable from outside your management network, treat that as the urgent finding, whatever the firmware says.
Because this is one of several upload and injection issues in the same appliance, do not treat each CVE as a separate task. The right unit of work is the device.
What to do now
- List all DAR-7000 units and their firmware strings.
- Block access to the web management interface from anything except a managed jump host.
- Search web server or proxy logs, if you keep any, for requests to /url/url.php from unexpected sources.
- Schedule decommissioning and pick a supported replacement.
- Record the end-of-support date in your asset register so the next review catches the next unsupported device earlier.
Why it matters
This CVE is the third in a run of reports against the same appliance, filed on the same day. Several sibling entries describe other pages with the same flaw class, and one describes command injection. When one product has that many independent findings, it usually means the code never had a consistent approach to validating input. Fixing one page would not have been enough, which may be part of why the vendor chose retirement.
It also shows why severity labels differ. VulDB called the issue critical while NVD scored it 6.3. The score depends on the privileges the attacker needs, and the vector here lists low privileges required. Read the vector, not just the label.
Try it yourself
An inventory is what tells you an unsupported device is still running. This demo shows how Safeguard builds a dependency inventory from a scan.
Click through it at your own pace, or open it full screen.
Quick check
Why do two sources rate this differently?
The description from VulDB calls it critical, while NVD's CVSS 3.1 base score is 6.3, Medium. They weigh factors such as required privileges differently. Both ratings are public.
Can I mitigate without replacing the device?
The vendor says retire and replace. Restricting management access reduces exposure but does not fix the code, so treat it as a stopgap.
Sources
- D-Link security announcement SAP10354
- VulDB entry
- Researcher write-up PDF linked from the NVD record (listed there, not fetched for this review).
Last reviewed: 19 October 2026.
