PT-2024-21969 · D Link · D-Link Dir-3040

Published 2024-03-29 · Updated 2024-09-04 · CVE-2024-27619

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dlink Dir-3040us A1 version 1.20b03a hotfix

Description The issue allows any user with read/write access to the ftp server to write directly to ram, causing a buffer overflow if the uploaded file or files exceed the available ram. The ftp server permits changing the directory to the root, which is one level up from the root of the usb flash directory. During upload, the ram becomes filled, leading to system resource exhaustion and causing the system to crash and reboot.

Recommendations For Dlink Dir-3040us A1 version 1.20b03a hotfix, as a temporary workaround, consider restricting access to the ftp server to minimize the risk of exploitation. Avoid using the ftp server for uploading files that are larger than the available ram until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-27619

Affected Products

D-Link Dir-3040

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-27619 · Security Note
• https://twitter.com/vuldb/status/1773826363260317969 · Twitter Post
• https://github.com/ioprojecton/dir-3040_dos · Note
• https://twitter.com/RedPacketSec/status/1775086915936461029 · Twitter Post
• https://twitter.com/CVEnew/status/1773721249249628624 · Twitter Post
• https://t.me/cvenotify/93230 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1773752695884546222 · Twitter Post
• https://dlink.com/en/security-bulletin · Note
• http://dir-3040us.com · Note