CVE-2024-24321 describes a critical remote code execution vulnerability in Dlink DIR-816A2 version 1.10CNB05. The flaw is triggered via the wizardstep4_ssid_2 parameter processed by the sub_42DA54 function, enabling unauthenticated remote attackers to execute arbitrary code. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the affected device, potentially leading to full compromise of the router. This can result in loss of confidentiality, integrity, and availability of the device and the network it serves.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the device's management interfaces and monitoring for unusual activity. Avoid exposing the device to untrusted networks.