CVE-2024-44340: D-Link DIR-846W RCE Vulnerability

CVE-2024-44340 Overview

CVE-2024-44340 is a remote command execution (RCE) vulnerability in the D-Link DIR-846W A1 router running firmware FW100A43. The flaw resides in the SetSmartQoSSettings handler, which improperly processes the smartqos_express_devices and smartqos_normal_devices parameters. An authenticated attacker on the network can inject operating system commands through these parameters and execute them with the privileges of the web management process. The vulnerability is classified under CWE-78: OS Command Injection.

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on affected D-Link DIR-846W routers, leading to full device compromise and potential lateral movement into the connected network.

Affected Products

D-Link DIR-846W A1 (hardware revision A1)
D-Link DIR-846W firmware version FW100A43
D-Link DIR-846W devices exposing the SetSmartQoSSettings endpoint

Discovery Timeline

2024-08-27 - CVE-2024-44340 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44340

Vulnerability Analysis

The DIR-846W web management interface exposes a Smart Quality of Service (QoS) configuration endpoint named SetSmartQoSSettings. This handler accepts device lists through the smartqos_express_devices and smartqos_normal_devices request parameters. The firmware passes these parameter values into an underlying shell context without sanitizing shell metacharacters such as ;, |, &, or backticks.

An attacker who reaches the router's HTTP interface and possesses low-privilege credentials can append shell commands to either parameter. The router then executes those commands as part of the QoS configuration routine. Because embedded router services typically run as root, successful exploitation yields full control of the device.

Device compromise enables DNS hijacking, traffic interception, credential theft from LAN clients, and pivoting into internal networks. Compromised routers are also commonly enrolled into IoT botnets.

Root Cause

The root cause is missing input validation and unsafe construction of shell command strings inside the SetSmartQoSSettings handler. User-supplied values from smartqos_express_devices and smartqos_normal_devices are concatenated into commands passed to a system shell, matching the classic OS command injection pattern described in CWE-78.

Attack Vector

Exploitation requires network access to the router's management interface and authenticated access with low privileges. The attacker sends a crafted HTTP request to the SetSmartQoSSettings endpoint with shell metacharacters embedded in the smartqos_express_devices or smartqos_normal_devices fields. The injected payload executes on the device.

Refer to the public proof-of-concept for CVE-2024-44340 and the D-Link Security Bulletin for technical details.

Detection Methods for CVE-2024-44340

Indicators of Compromise

HTTP POST requests to management endpoints referencing SetSmartQoSSettings that contain shell metacharacters (;, |, &, `, $() in smartqos_express_devices or smartqos_normal_devices values.
Unexpected outbound connections initiated from the router's WAN interface to unknown hosts, including TFTP, wget, or curl-style downloads.
New or modified processes on the router such as reverse shells, cryptominers, or persistence scripts written to /tmp or /var.
Changes to router DNS settings, firewall rules, or administrative credentials without an authorized change record.

Detection Strategies

Inspect HTTP request logs from the router and any upstream proxy for parameter values in SetSmartQoSSettings that do not match expected MAC or IP list formats.
Deploy network intrusion detection signatures that flag command injection patterns in HTTP bodies destined for D-Link router management ports.
Correlate authenticated router logins with subsequent QoS configuration changes to identify anomalous administrative activity.

Monitoring Recommendations

Forward router syslog, DHCP, and DNS telemetry to a centralized analytics platform for behavioral baselining of management-plane activity.
Monitor endpoints on the LAN for signs of downstream compromise such as credential theft, ARP spoofing, or unexpected TLS certificate warnings that may indicate a hijacked router.
Alert on any router configuration export or firmware change events outside approved maintenance windows.

How to Mitigate CVE-2024-44340

Immediate Actions Required

Restrict access to the router's web management interface to trusted LAN segments only and disable any remote (WAN-side) administration.
Rotate the router administrator password and disable default or shared credentials that could be reused by an attacker to reach SetSmartQoSSettings.
Audit the router configuration for unauthorized DNS servers, port forwards, firewall rules, or added administrator accounts.
Isolate DIR-846W A1 devices on a segmented VLAN pending vendor guidance, given that the device is a legacy consumer model.

Patch Information

At the time of the last NVD update on 2026-06-17, no vendor patch has been referenced in the CVE record. Review the D-Link Security Bulletin portal and the D-Link DIR-846W product page for firmware updates or end-of-life notices. If no fixed firmware is available, treat the device as unsupported and plan replacement with a currently maintained router.

Workarounds

Disable the Smart QoS feature in the router's web interface where possible to reduce exposure of the SetSmartQoSSettings handler.
Enforce strong, unique administrator credentials and enable account lockout to slow credential-based access to the management interface.
Place the router behind an upstream firewall that restricts inbound access to its management ports from untrusted networks.
Replace end-of-support DIR-846W A1 hardware with a maintained platform that receives regular security updates.

bash

# Example: block external access to the router management interface
# Replace 192.0.2.10 with the router LAN IP and adjust interfaces as needed
iptables -A FORWARD -i wan0 -d 192.0.2.10 -p tcp --dport 80  -j DROP
iptables -A FORWARD -i wan0 -d 192.0.2.10 -p tcp --dport 443 -j DROP

# Restrict management access to a trusted admin subnet only
iptables -A INPUT -p tcp --dport 80  ! -s 192.0.2.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 ! -s 192.0.2.0/24 -j DROP