On this page
Atomicorp WAF Rule 381237
Rule Summary
- Rule ID: 381237
- Status: Active
- Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: DLINK worm probe
- Observed CWEs: CWE-77 (3), CWE-78 (4), CWE-119 (2), CWE-121 (1)
- Revision: 1
- Rule severity: Critical (2)
- Request surfaces: Request URI
- Rule action: deny
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: DLINK worm probe” in the request URI. denies matching traffic.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2014-3936 | D-Link HNAP Request Remote Buffer Overflow | dir505 shareport mobile companion firmware | 10.0 (v2.0) | High |
| CVE-2016-6563 | Dlink DIR Routers Unauthenticated HNAP Login Stack Buffer Overflow | dir-823 firmware | 9.8 (v3.0) | Critical |
| CVE-2019-20215 | D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet. | dir-859 firmware | 9.8 (v3.1) | Critical |
| CVE-2020-15893 | D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet. | dir-816l firmware | 9.8 (v3.1) | Critical |
| CVE-2023-33625 | D-Link Unauthenticated Remote Command Execution using UPnP via a special crafted M-SEARCH packet. | dir-600 firmware | 9.8 (v3.1) | Critical |
| CVE-2026-110536 | D-Link DIR-868L HNAP CGI cgibin system os command injection | DIR-868L | 9.3 (v4.0) | Critical |
| CVE-2015-2051 | D-Link Devices HNAP SOAPAction-Header Command Execution | dir-645 firmware | 8.8 (v3.1) | High |
| CVE-2022-46552 | D-Link DIR-846 - Remote Command Execution (RCE) vulnerability | dir-846 firmware | 8.8 (v3.1) | High |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
| CWE | Related Published CVEs |
|---|---|
| CWE-77 | CVE-2023-33625 , CVE-2026-110536 , CVE-2015-2051 |
| CWE-78 | CVE-2019-20215 , CVE-2020-15893 , CVE-2026-110536 , CVE-2022-46552 |
| CWE-119 | CVE-2014-3936 , CVE-2016-6563 |
| CWE-121 | CVE-2016-6563 |