PT-2024-9741 · D Link · D-Link Dap-1520

Chuan Qin · Published 2024-05-24 · Updated 2024-12-17 · CVE-2024-36831

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions D-Link DAP-1520 version REVA FIRMWARE 1.10B04 BETA02 HOTFIX

Description A NULL pointer dereference in the plugins call handle uri clean function allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request without authentication. The issue is related to errors in pointer dereference due to incorrect checking of the HTTP request format. Exploitation of the issue may allow a remote attacker to cause a denial of service by sending specially crafted HTTP requests.

Recommendations For D-Link DAP-1520 version REVA FIRMWARE 1.10B04 BETA02 HOTFIX, as a temporary workaround, consider disabling the plugins call handle uri clean function until a patch is available. Restrict access to the vulnerable plugins call handle uri clean function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2024-11477

CVE-2024-36831

Affected Products

D-Link Dap-1520

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-36831 · Security Note
• https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10395 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36831 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11477 · Security Note
• https://dlink.com/en · Note
• https://twitter.com/VulmonFeeds/status/1869055933424259153 · Twitter Post
• https://docs.google.com/document/d/15CVb7XHIgtfeW1W1pLZJWvlBMYN1rtr75vqZqf1v3Eo/edit?usp=sharing · Note
• https://dlink.com/en/security-bulletin · Note
• https://t.me/cvedetector/13098 · Telegram Post
• https://vuldb.com/?id.288750 · Note
• https://twitter.com/CVEnew/status/1869043493265383860 · Twitter Post