PT-2024-6453 · D Link · D-Link Dns-1200-05+16

Buaai0Tteam · Published 2024-04-04 · Updated 2024-08-19 · CVE-2024-7828

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 (affected versions not specified)

Description The issue is related to a buffer overflow vulnerability in the cgi set cover() function of the /cgi-bin/photocenter mgr.cgi file. This vulnerability can be exploited remotely by manipulating the album name argument, allowing an attacker to execute arbitrary commands using a specially crafted POST request. The estimated number of potentially affected devices is not provided, and there is no information about real-world incidents where this issue was exploited.

Recommendations As a temporary workaround, consider disabling the cgi set cover() function until a patch is available. Restrict access to the /cgi-bin/photocenter mgr.cgi file to minimize the risk of exploitation. Avoid using the album name argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-07539

CVE-2024-7828

Affected Products

D-Link Dnr-202L

D-Link Dnr-322L

D-Link Dns-326

D-Link Dns-1100-4

D-Link Dns-120

D-Link Dns-1200-05

D-Link Dns-1550-04

D-Link Dns-315L

D-Link Dns-320

D-Link Dns-321

D-Link Dns-323

D-Link Dns-325

D-Link Dns-327L

D-Link Dns-340L

D-Link Dns-343

D-Link Dns-345

D-Link Dns-726-4

References · 14

• 🔥❌ https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_set_cover.md · Exploit, Deleted
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7828 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-7828/change-record?changeRecordedOn=08/15/2024T09:15:13.197-0400 · Security Note
• https://bdu.fstec.ru/vul/2024-07539 · Security Note
• https://vuldb.com/?ctiid.274726 · Note
• https://t.me/cvenotify/90728 · Telegram Post
• https://twitter.com/CveFindCom/status/1824069680283160673 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1824091667739070924 · Twitter Post
• https://vuldb.com/?submit.390114 · Note
• https://twitter.com/CVEnew/status/1824077699586953705 · Twitter Post
• https://vuldb.com/?id.274726 · Note
• https://twitter.com/cracbot/status/1825774843373261151 · Twitter Post
• https://t.me/cvedetector/3236 · Telegram Post