Lucene search

VulDBVULNRICHMENT:CVE-2024-8461

HistorySep 05, 2024 - 12:31 p.m.

CVE-2024-8461 D-Link DNS-320 Web Management Interface discovery.cgi information disclosure

2024-09-0512:31:05

CWE-200

VulDB

github.com

vulnerability

d-link dns-320

information disclosure

web management interface

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

23.7%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A vulnerability, which was classified as problematic, was found in D-Link DNS-320 2.02b01. This affects an unknown part of the file /cgi-bin/discovery.cgi of the component Web Management Interface. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*"
    ],
    "vendor": "dlink",
    "product": "dns-320",
    "versions": [
      {
        "status": "affected",
        "version": "2.02b01"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/leetsun/IoT-Vuls/tree/main/Dlink-dns320/4

supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383

vuldb.com/?ctiid.276627

vuldb.com/?id.276627

vuldb.com/?submit.401300

www.dlink.com/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

23.7%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-8461