CVE-2024-33112: D-Link DIR-845L Firmware RCE Vulnerability

CVE-2024-33112 Overview

CVE-2024-33112 is a command injection vulnerability in the D-Link DIR-845L wireless router. Firmware versions v1.01KRb03 and earlier are affected. The flaw resides in the hnap_main() function, which handles Home Network Administration Protocol (HNAP) requests. Attackers can inject operating system commands through this function over the network without authentication. Successful exploitation results in execution of arbitrary commands on the router, leading to availability impact on the device. The vulnerability is tracked under [CWE-77] Command Injection and [CWE-78] OS Command Injection.

Critical Impact
Unauthenticated network attackers can inject OS commands through the hnap_main() function on affected D-Link DIR-845L routers, compromising device availability and integrity.

Affected Products

D-Link DIR-845L router (hardware)
D-Link DIR-845L firmware version v1.01KRb03
D-Link DIR-845L firmware versions prior to v1.01KRb03

Discovery Timeline

2024-05-06 - CVE-2024-33112 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-33112

Vulnerability Analysis

The vulnerability exists in the hnap_main() function on the DIR-845L router. This function parses HNAP requests sent to the router's management interface. Input received through HNAP parameters is passed to a system shell without proper sanitization or validation. Attackers can append shell metacharacters such as semicolons or backticks to inject arbitrary commands. Because routers expose HNAP over the LAN and, in some configurations, the WAN, remote exploitation is feasible. The injected commands execute with the privileges of the web management process, typically root on embedded D-Link devices.

Root Cause

The root cause is missing input validation in the hnap_main() handler. User-controlled fields from HNAP SOAP requests reach a command execution primitive such as system() or popen() without escaping. This pattern matches [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HNAP request containing shell metacharacters in a vulnerable parameter. The hnap_main() function concatenates the attacker-controlled value into a shell command string. The resulting command runs in the device's underlying Linux shell. Public proof-of-concept material is referenced in the GitHub D-LINK PoC writeup.

No verified exploit code is reproduced here. Refer to the linked PoC repository for technical request structure and parameter details.

Detection Methods for CVE-2024-33112

Indicators of Compromise

Unexpected HTTP/SOAP POST requests to /HNAP1/ containing shell metacharacters such as ;, |, `, or $() in SOAP body fields.
Outbound connections from the router to unfamiliar external hosts, particularly on ports used for reverse shells or tunneling.
New or modified processes on the router that were not part of the stock firmware image.

Detection Strategies

Inspect web server and HNAP request logs on the router for anomalous payloads containing command separators or download utilities like wget, curl, or tftp.
Deploy network IDS signatures that match HNAP SOAP requests containing shell metacharacters targeting hnap_main() endpoints.
Monitor for HNAP traffic originating from the WAN interface, which should typically be blocked.

Monitoring Recommendations

Forward router syslog and management plane logs to a centralized SIEM for correlation against known HNAP exploitation patterns.
Alert on repeated failed or malformed HNAP requests from a single source, indicating fuzzing or exploitation attempts.
Track firmware version inventory to identify unpatched DIR-845L devices on the network.

How to Mitigate CVE-2024-33112

Immediate Actions Required

Restrict access to the router's web management interface to trusted internal hosts only and disable remote (WAN-side) management.
Block inbound HNAP traffic at the network perimeter to prevent unauthenticated exploitation attempts.
Audit DIR-845L devices on the network and segment them away from sensitive systems until they can be replaced or remediated.

Patch Information

The D-Link DIR-845L reached end-of-life status, and no vendor advisory or fixed firmware version is listed in the available CVE references. Organizations should treat affected devices as unsupported and plan replacement with a currently supported router model. Monitor the D-Link support portal for any retroactive guidance.

Workarounds

Replace affected DIR-845L hardware with a vendor-supported router that receives security updates.
Disable the HNAP service if the firmware exposes a configuration option to do so.
Place vulnerable devices behind a firewall that blocks all inbound traffic to the management interface and inspects HNAP request payloads.

bash

# Example perimeter firewall rule to block inbound HNAP requests
iptables -A FORWARD -p tcp --dport 80 -m string \
  --string "/HNAP1/" --algo bm -j DROP
iptables -A FORWARD -p tcp --dport 443 -m string \
  --string "/HNAP1/" --algo bm -j DROP