Lucene search

VulDBCVE-2024-8461

HistorySep 05, 2024 - 1:15 p.m.

CVE-2024-8461

2024-09-0513:15:11

CWE-200

VulDB

web.nvd.nist.gov

cve-2024-8461

d-link dns-320

web management interface

information disclosure

remote attack

end-of-life

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

23.7%

JSON

A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Affected configurations

Nvd

Node

dlinkdns-320_firmwareMatch2.02b01

AND

dlinkdns-320Match-

VendorProductVersionCPE
dlinkdns-320_firmware2.02b01cpe:2.3:o:dlink:dns-320_firmware:2.02b01:*:*:*:*:*:*:*
dlinkdns-320-cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dlink	dns-320_firmware	2.02b01	cpe:2.3:o:dlink:dns-320_firmware:2.02b01:::::::*
dlink	dns-320	-	cpe:2.3:h:dlink:dns-320:-:::::::*

CNA Affected

[
  {
    "vendor": "D-Link",
    "product": "DNS-320",
    "versions": [
      {
        "version": "2.02b01",
        "status": "affected"
      }
    ],
    "modules": [
      "Web Management Interface"
    ]
  }
]

References

github.com/leetsun/IoT-Vuls/tree/main/Dlink-dns320/4

supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383

vuldb.com/?ctiid.276627

vuldb.com/?id.276627

vuldb.com/?submit.401300

www.dlink.com/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

23.7%

JSON

Related for CVE-2024-8461