PT-2024-5013 · D Link · D-Link Go-Rt-Ac750

Sunwithmoon · Published 2024-03-21 · Updated 2024-08-14 · CVE-2024-27683

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: D-Link Go-RT-AC750 version GORTAC750 A1 FW v101b03

Description: The issue is related to a stack-based buffer overflow via the hnap main function. An attacker can send a POST request to trigger the issue, potentially allowing a remote attacker to cause a denial of service. The vulnerability can be exploited by sending specially crafted POST requests.

Recommendations: For D-Link Go-RT-AC750 version GORTAC750 A1 FW v101b03, as a temporary workaround, consider disabling the hnap main function until a patch is available. Restrict access to the vulnerable API endpoint to minimize the risk of exploitation. Avoid using the vulnerable function in the affected device until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2024-05537

CVE-2024-27683

Affected Products

D-Link Go-Rt-Ac750

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-27683 · Security Note
• https://bdu.fstec.ru/vul/2024-05537 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27683 · Vendor Advisory
• https://gist.github.com/sunwithmoon/428c3871482a600382fec0a1994a518b · Note
• https://drive.google.com/file/d/18RhbBnaD_kH16Y6C-7TpSSPUmYKKyU_k/view · Note
• https://dlink.com/en/security-bulletin · Note
• https://twitter.com/CVEnew/status/1770780528519618908 · Twitter Post
• https://twitter.com/vuldb/status/1770804942934061460 · Twitter Post
• https://t.me/cvenotify/90640 · Telegram Post