PT-2024-3258 · Keenetic · Keenetic Kn-1711+4
Published
2024-04-21
·
Updated
2024-05-17
·
CVE-2024-4021
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Keenetic KN-1010, KN-1410, KN-1711, KN-1810, and KN-1910 versions up to 4.1.2.15
Description
A vulnerability was found in the file /ndmComponents.js of the component Configuration Setting Handler, which can lead to information disclosure. The attack can be launched remotely. The issue is related to insufficient protection of service data. The vendor is aware of this issue and plans to fix it.
Recommendations
For Keenetic KN-1010, KN-1410, KN-1711, KN-1810, and KN-1910 versions up to 4.1.2.15, consider restricting access to the /ndmComponents.js file until a patch is available. As a temporary workaround, limit the use of the Configuration Setting Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Keenetic Kn-1010
Keenetic Kn-1410
Keenetic Kn-1711
Keenetic Kn-1810
Keenetic Kn-1910