CVE-2024-13106

CVE-2024-13106 is an improper access control flaw (CWE-266/CWE-284) in the IP QoS Handler of the D-Link DIR-816 A2 router, specifically in the /goform/form2IPQoSTcAdd handler. A remote attacker can send crafted requests to this endpoint without authentication (CVSS PR:N, UI:N) and manipulate the QoS handling logic in an unauthorized way. Per the CVSS 4.0 vector, the impact is limited to integrity: an attacker can make unauthorized changes (VI:L) with no direct confidentiality or availability impact, likely altering router QoS or related settings. Only D-Link DIR-816 A2 units running firmware 1.10CNB05_R1B011D88210 are identified as affected in the available data. The vulnerability is not yet listed in CISA KEV and no standalone PoC is catalogued, but the source description states an exploit has been publicly disclosed, and EPSS assigns a high 27.2% probability of exploitation within 30 days (98th percentile), so defenders should treat exploitation as plausible in the near term.

What to do: Check whether any internet-exposed D-Link DIR-816 A2 units run firmware 1.10CNB05_R1B011D88210 and upgrade to the latest firmware offered by D-Link for the A2 revision if a fix has been released (no fixed version is specified in the available data). Until patched, restrict the router's web management interface to the local network and avoid port-forwarding or remote-management exposure, since the flaw is exploitable remotely without authentication. Watch for the CVE's addition to CISA KEV or published PoCs given the high EPSS score.