CVE-2024-8460

A vulnerability, which was classified as problematic, has been found in D-Link DNS-320 2.02b01. Affected by this issue is some unknown functionality of the file /cgi-bin/widget_api.cgi of the component Web Management Interface. The manipulation of the argument getHD/getSer/getSys leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:dlink:dns-320_firmware:2.02b01:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*

History

06 Sep 2024, 16:30

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CVSS v2 : 2.6
v3 : 3.7
v2 : 2.6
v3 : 5.9
Summary
  • (es) Se ha encontrado una vulnerabilidad, que se ha clasificado como problemática, en D-Link DNS-320 2.02b01. Este problema afecta a algunas funciones desconocidas del archivo /cgi-bin/widget_api.cgi del componente Interfaz de gestión web. La manipulación del argumento getHD/getSer/getSys conduce a la divulgación de información. El ataque puede iniciarse de forma remota. La complejidad de un ataque es bastante alta. Se sabe que la explotación es difícil. El exploit se ha divulgado al público y puede utilizarse. NOTA: Esta vulnerabilidad solo afecta a los productos que ya no reciben soporte del fabricante. Se contactó primeramente con el proveedor y confirmó que el producto ha llegado al final de su vida útil. Debería retirarse y reemplazarse.
CPE cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320_firmware:2.02b01:*:*:*:*:*:*:*
References () https://github.com/leetsun/IoT-Vuls/tree/main/Dlink-dns320/1 - () https://github.com/leetsun/IoT-Vuls/tree/main/Dlink-dns320/1 - Exploit, Third Party Advisory
References () https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - () https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 - Vendor Advisory
References () https://vuldb.com/?ctiid.276626 - () https://vuldb.com/?ctiid.276626 - Permissions Required
References () https://vuldb.com/?id.276626 - () https://vuldb.com/?id.276626 - Permissions Required, Third Party Advisory
References () https://vuldb.com/?submit.401297 - () https://vuldb.com/?submit.401297 - Third Party Advisory, VDB Entry
References () https://www.dlink.com/ - () https://www.dlink.com/ - Product
First Time Dlink dns-320
Dlink
Dlink dns-320 Firmware

05 Sep 2024, 12:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-05 12:15

Updated : 2024-09-06 16:30


NVD link : CVE-2024-8460

Mitre link : CVE-2024-8460

CVE.ORG link : CVE-2024-8460


JSON object : View

Products Affected

dlink

  • dns-320
  • dns-320_firmware
CWE
NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor