CVE-2024-0717

CVSS v3.1

5.3

Medium

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions D-Link DAP-1360 versions prior to 20240112 D-Link DIR-300 versions prior to 20240112 D-Link DIR-615 versions prior to 20240112 D-Link DIR-615GF versions prior to 20240112 D-Link DIR-615S versions prior to 20240112 D-Link DIR-615T versions prior to 20240112 D-Link DIR-620 versions prior to 20240112 D-Link DIR-620S versions prior to 20240112 D-Link DIR-806A versions prior to 20240112 D-Link DIR-815 versions prior to 20240112 D-Link DIR-815AC versions prior to 20240112 D-Link DIR-815S versions prior to 20240112 D-Link DIR-816 versions prior to 20240112 D-Link DIR-820 versions prior to 20240112 D-Link DIR-822 versions prior to 20240112 D-Link DIR-825 versions prior to 20240112 D-Link DIR-825AC versions prior to 20240112 D-Link DIR-825ACF versions prior to 20240112 D-Link DIR-825ACG1 versions prior to 20240112 D-Link DIR-841 versions prior to 20240112 D-Link DIR-842 versions prior to 20240112 D-Link DIR-842S versions prior to 20240112 D-Link DIR-843 versions prior to 20240112 D-Link DIR-853 versions prior to 20240112 D-Link DIR-878 versions prior to 20240112 D-Link DIR-882 versions prior to 20240112 D-Link DIR-1210 versions prior to 20240112 D-Link DIR-1260 versions prior to 20240112 D-Link DIR-2150 versions prior to 20240112 D-Link DIR-X1530 versions prior to 20240112 D-Link DIR-X1860 versions prior to 20240112 D-Link DSL-224 versions prior to 20240112 D-Link DSL-245GR versions prior to 20240112 D-Link DSL-2640U versions prior to 20240112 D-Link DSL-2750U versions prior to 20240112 D-Link DSL-G2452GR versions prior to 20240112 D-Link DVG-5402G versions prior to 20240112 D-Link DVG-5402GFRU versions prior to 20240112 D-Link DVG-N5402G versions prior to 20240112 D-Link DVG-N5402G-IL versions prior to 20240112 D-Link DWM-312W versions prior to 20240112 D-Link DWM-321 versions prior to 20240112 D-Link DWR-921 versions prior to 20240112 D-Link DWR-953 versions prior to 20240112 Good Line Router v2 versions prior to 20240112

Description The issue is related to insufficient protection of service data when handling the area parameter in the devinfo interface of D-Link router firmware. This can be exploited by sending a specially crafted GET request, allowing a remote attacker to gain unauthorized access to protected information. The manipulation of the area argument with the input notice|net|version leads to information disclosure. The attack can be initiated remotely.

Recommendations For all affected versions, consider disabling the HTTP GET Request Handler for the /devinfo component until a patch is available. Restrict access to the /devinfo endpoint to minimize the risk of exploitation. Avoid using the area parameter in the affected HTTP GET Request Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-00634

CVE-2024-0717

Affected Products

Dap-1360

Dir-1210

Dir-1260

Dir-2150

Dir-300

Dir-615

Dir-615Gf

Dir-620

Dir-806

Dir-815

Dir-815Ac

Dir-816

Dir-820

Dir-822

Dir-825

Dir-825Ac

Dir-825Acg1

Dir-841

Dir-842

Dir-843

Dir-853

Dir-878

Dir-882

Dir-X1530

Dir-X1860

Dsl-224

Dsl-245Gr

Dsl-2640U

Dsl-2750U

Dsl-G2452Gr

Dvg-5402G

Dvg-5402Gfru

Dvg-N5402G

Dvg-N5402G-Il

Dwm-312W

Dwm-321

Dwr-921

Dwr-953

CVE-2024-0717

Weakness Enumeration

Related Identifiers

Affected Products

References · 8