CVE-2024-4964 is a medium severity (CVSS 6.3) unrestricted upload in the D-Link DAR-7000-40, in the firewall page /firewall/urlblist.php. The device has reached end-of-life and D-Link has no firmware to offer. Retire it and keep the admin interface away from untrusted networks.
What's affected
D-Link DAR-7000-40 firmware V31R02B1413C, the version named in the record, along with the DAR-7000 hardware entry. The affected page is /firewall/urlblist.php, which sits in the firewall section of the web interface, and the argument named file is the one manipulated. The record says the attack can be started remotely and that an exploit has been disclosed.
The record carries an unsupported-when-assigned notice. It says the product is end-of-life and that the vendor, once contacted, confirmed this straight away and said the device should be retired and replaced. There is no fixed version to move to.
The sources differ on severity. The description, taken from VulDB, calls the issue critical. The NVD CVSS score is 6.3, which is Medium. Both are published, and neither changes the advice.
The weakness class is CWE-434, unrestricted upload of file with dangerous type. The record scores it 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
Start by working out whether you own one. DAR-7000 is a business-class appliance, and the record is specific to the DAR-7000-40 build named above. Check asset inventories and network scans for D-Link management interfaces, and check the firmware string in the device's admin page against V31R02B1413C.
The D-Link announcement SAP10354 covers the DAR-7000 and lists fixed firmware as not available. The page text I retrieved referred to other CVE identifiers than this one, so confirm directly with D-Link or your regional office that the advisory covers this CVE for your hardware revision.
If the admin interface is reachable from outside your management network, treat that as the urgent finding, whatever the firmware says.
A URL blocklist page on a firewall-style device is something administrators use rarely. If your logs show hits on /firewall/urlblist.php that nobody on the team can explain, escalate them.
What to do now
- Confirm whether any DAR-7000 remains in service.
- Put the management interface behind a VPN or a dedicated management VLAN.
- Pull access logs for /firewall/urlblist.php and ask the admins whether each hit was theirs.
- Order a supported replacement and set a decommission date.
- After the device is removed, rotate any credentials that were stored on it.
Why it matters
Uploading a file is not dangerous in itself. It becomes dangerous when the server trusts the file's name or declared type, and then stores it somewhere the web server will execute or hand out. The advisory text does not state what this particular page does with the upload, so I will say only that the class of weakness is well understood and that the standard defence is an allowlist of types, storage outside the web root and no execution rights.
For a network security appliance, the stakes are higher than for a hobby website, because the device sits in a trusted position. That is the argument for retiring unsupported gear rather than monitoring it.
Quick check
Does this affect the firewall rules themselves?
The record only says an upload flaw exists in the URL blocklist page. It does not say what an attacker can change, so check the vendor announcement before assuming more.
Sources
- D-Link security announcement SAP10354
- VulDB entry
- Researcher write-up PDF linked from the NVD record (listed there, not fetched for this review).
Last reviewed: 19 October 2026.
