CVE-2024-4965 is a medium severity (CVSS 6.3) OS command injection in the D-Link DAR-7000-40, in /useratte/resmanage.php through the load argument. The product is end-of-life and no fix is planned. D-Link recommends retiring and replacing the device, and until then keeping the admin interface off untrusted networks.
What's affected
D-Link DAR-7000-40 firmware V31R02B1413C, the version named in the record, along with the DAR-7000 hardware entry. The page is /useratte/resmanage.php, the same file as CVE-2024-4962, but the manipulated argument here is load and the flaw is command injection rather than upload. The record says remote initiation is possible and a public exploit exists.
The record carries an unsupported-when-assigned notice. It says the product is end-of-life and that the vendor, once contacted, confirmed this straight away and said the device should be retired and replaced. There is no fixed version to move to.
The sources differ on severity. The description, taken from VulDB, calls the issue critical. The NVD CVSS score is 6.3, which is Medium. Both are published, and neither changes the advice.
The weakness class is CWE-78, improper neutralization of special elements in an OS command. The record scores it 6.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
How to check if you're exposed
Start by working out whether you own one. DAR-7000 is a business-class appliance, and the record is specific to the DAR-7000-40 build named above. Check asset inventories and network scans for D-Link management interfaces, and check the firmware string in the device's admin page against V31R02B1413C.
The D-Link announcement SAP10354 covers the DAR-7000 and lists fixed firmware as not available. The page text I retrieved referred to other CVE identifiers than this one, so confirm directly with D-Link or your regional office that the advisory covers this CVE for your hardware revision.
If the admin interface is reachable from outside your management network, treat that as the urgent finding, whatever the firmware says.
What to do now
- Inventory all DAR-7000 devices and confirm firmware.
- Restrict the interface to a management network and require a VPN to reach it.
- Treat the device as potentially exposed if it ever faced the internet, and review its configuration for changes you cannot explain.
- Replace it with a supported appliance on a dated plan.
- Document the exception and its expiry if the unit has to run for a short time.
Why it matters
OS command injection means input meant to be data ends up being interpreted by the system shell. It is a more direct route to running things on a device than an upload flaw, which is why many teams rank it above upload bugs even when the score is the same. The CVSS vector here shows low impact on each of confidentiality, integrity and availability, which is on the conservative side for this class, so do not lean on the number alone.
The record has no statement of in-the-wild use and is not marked as a KEV entry. The risk is that a public exploit exists against a device that will never be patched.
Quick check
How is this different from CVE-2024-4962?
Same file, different argument and flaw class. CVE-2024-4962 is an unrestricted upload through the file argument, while this one is command injection through load.
Will a web application firewall fix it?
It may block some requests, but the vendor's position is replacement. A filter in front of an unpatched device is a stopgap.
Sources
- D-Link security announcement SAP10354
- VulDB entry
- Researcher write-up PDF linked from the NVD record (listed there, not fetched for this review).
Last reviewed: 19 October 2026.
