PT-2025-3421 · Prolink · Prolink 4G Lte Mobile Wi-Fi Dl-7203E

Published 2025-02-03 · Updated 2025-02-03 · CVE-2024-57238

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Prolink 4G LTE Mobile Wi-Fi DL-7203E version 4.0.0B05

Description The issue allows an attacker to manipulate SQL queries by injecting malicious SQL code into the order by parameter in the "/reqproc/proc get" endpoint. This enables the attacker to alter the SQL queries, potentially leading to unauthorized data access or modification.

Recommendations For version 4.0.0B05, as a temporary workaround, consider restricting access to the "/reqproc/proc get" endpoint to minimize the risk of exploitation. Avoid using the order by parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-57238

Affected Products

Prolink 4G Lte Mobile Wi-Fi Dl-7203E

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-57238 · Security Note
• https://harryha.substack.com/p/4g-lte-mobile-wifi-dl7203e-sqli-cve-2024-57238 · Note
• https://twitter.com/CVEnew/status/1886499096065925619 · Twitter Post
• https://prolink2u.com/products/dl-7203e-b · Note