D-Link Routers Incorrect Use Of Privileged APIs (CVE-2024-11068)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(211678);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/11/22");

  script_cve_id("CVE-2024-11068");

  script_name(english:"D-Link Routers Incorrect Use Of Privileged APIs (CVE-2024-11068)");

  script_set_attribute(attribute:"synopsis", value:
"The remote router is affected by an incorrect use of privileged APIs vulnerability.");
  script_set_attribute(attribute:"description", value:
"The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote 
attackers to modify any user’s password by leveraging the API, thereby granting access to Web, SSH, and Telnet 
services using that user’s account.

Note that Nessus has not tested for this issue but has instead relied only on the router's self-reported model.");
  script_set_attribute(attribute:"see_also", value:"https://www.twcert.org.tw/en/cp-139-8234-0514c-2.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to a supported device.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-11068");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/11/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dlink:dsl6740c_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("d-link_router_detect.nasl");
  script_require_keys("www/d-link", "d-link/model");
  script_require_ports("Services/www", 80);

  exit(0);
}

include('http.inc');

var model = toupper(get_kb_item_or_exit('d-link/model'));
if (model != 'DSL6740C')
  audit(AUDIT_HOST_NOT, 'an affected D-Link model');

var port = get_http_port(default:80, embedded:1);
var items = make_array('Model', model, 'Solution', 'Upgrade to a supported device');
var order = make_list('Model', 'Solution');
var report = report_items_str(report_items:items, ordered_fields:order);

security_report_v4(port:port, severity:SECURITY_HOLE, extra:report);