PT-2024-6451 · D Link · D-Link Dns-320

Leetmoon

·

Published

2024-09-04

·

Updated

2024-09-06

·

CVE-2024-8460

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions D-Link DNS-320 version 2.02b01
Description A problematic issue has been found in the Web Management Interface of the D-Link DNS-320, specifically in the file /cgi-bin/widget api.cgi. The manipulation of the getHD, getSer, or getSys argument leads to information disclosure. This issue can be exploited remotely, but the complexity of an attack is rather high, and the exploitation is known to be difficult. The product is end-of-life and should be retired and replaced.
Recommendations As a temporary workaround, consider disabling the /cgi-bin/widget api.cgi file until the issue is resolved. Restrict access to the Web Management Interface to minimize the risk of exploitation. Avoid using the getHD, getSer, or getSys argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-07537
CVE-2024-8460

Affected Products

D-Link Dns-320