Vulnerabilites related to D-Link - DAP-1360
cve-2023-32146
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2025-02-05 20:40
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 Multiple Parameters Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the /cgi-bin/webproc endpoint. When parsing the errorpage and nextpage parameters, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18746.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-538/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:dlink:dap-1360:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360", vendor: "dlink", versions: [ { lessThanOrEqual: "v6.14b01", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2023-32146", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-21T17:29:14.430443Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121 Stack-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-05T20:40:39.745Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:28.933Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-538", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-538/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T20:16:42.989Z", datePublic: "2023-05-04T22:15:48.040Z", descriptions: [ { lang: "en", value: "D-Link DAP-1360 Multiple Parameters Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the /cgi-bin/webproc endpoint. When parsing the errorpage and nextpage parameters, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18746.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121: Stack-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:14.151Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-538", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-538/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Dmitry \"InfoSecDJ\" Janushkevich of Trend Micro Zero Day Initiative", }, title: "D-Link DAP-1360 Multiple Parameters Stack-Based Buffer Overflow Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32146", datePublished: "2024-05-03T01:56:31.665Z", dateReserved: "2023-05-03T20:10:47.059Z", dateUpdated: "2025-02-05T20:40:39.745Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32140
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2025-02-05 20:46
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. When parsing the var:sys_Token parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18418.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-532/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:dlink:dap-1360:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360", vendor: "dlink", versions: [ { lessThanOrEqual: "v6.14b01", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "HIGH", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2023-32140", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-21T17:15:13.341341Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121 Stack-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-05T20:46:14.766Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.168Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-532", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-532/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T20:16:42.952Z", datePublic: "2023-05-04T22:15:02.754Z", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. When parsing the var:sys_Token parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18418.", }, ], metrics: [ { cvssV3_0: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "CWE-122: Heap-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:09.741Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-532", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-532/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32140", datePublished: "2024-05-03T01:56:27.034Z", dateReserved: "2023-05-03T20:10:47.059Z", dateUpdated: "2025-02-05T20:46:14.766Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32143
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2025-02-05 20:43
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of requests to the /cgi-bin/webupg endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18423.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-535/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:dlink:dap-1360:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360", vendor: "dlink", versions: [ { lessThanOrEqual: "v6.14b01", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2023-32143", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-21T17:24:11.124261Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-197", description: "CWE-197 Numeric Truncation Error", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2025-02-05T20:43:14.759Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.243Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-535", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-535/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T20:16:42.971Z", datePublic: "2023-05-04T22:15:25.620Z", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of requests to the /cgi-bin/webupg endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18423.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-197", description: "CWE-197: Numeric Truncation Error", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:11.976Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-535", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-535/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webupg UPGCGI_CheckAuth Numeric Truncation Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32143", datePublished: "2024-05-03T01:56:29.312Z", dateReserved: "2023-05-03T20:10:47.059Z", dateUpdated: "2025-02-05T20:43:14.759Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32141
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2024-09-18 18:28
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webproc WEB_DisplayPage Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. When parsing the getpage and errorpage parameters, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18419.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-533/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:d-link:dap-1360:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360", vendor: "d-link", versions: [ { lessThanOrEqual: "6.14b01", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:h:d-link:dap-2020:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-2020", vendor: "d-link", versions: [ { lessThanOrEqual: "1.03b01", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-32141", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-08T17:53:07.699942Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-05T19:35:45.730Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.144Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-533", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-533/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T15:16:42.958-05:00", datePublic: "2023-05-04T17:15:11.694-05:00", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webproc WEB_DisplayPage Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. When parsing the getpage and errorpage parameters, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18419.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121: Stack-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:10.492Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-533", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-533/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webproc WEB_DisplayPage Stack-based Buffer Overflow Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32141", datePublished: "2024-05-03T01:56:27.792Z", dateReserved: "2023-05-03T20:10:47.059Z", dateUpdated: "2024-09-18T18:28:10.492Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32139
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2024-09-18 18:28
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18417.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-531/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:d-link:dap-1360:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360", vendor: "d-link", versions: [ { status: "affected", version: "-", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-32139", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-07T19:43:13.679882Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-04T17:26:10.088Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.159Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-531", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-531/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T15:16:42.946-05:00", datePublic: "2023-05-04T17:14:56.532-05:00", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18417.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121: Stack-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:08.994Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-531", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-531/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32139", datePublished: "2024-05-03T01:56:26.198Z", dateReserved: "2023-05-03T20:10:47.058Z", dateUpdated: "2024-09-18T18:28:08.994Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32144
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2024-09-18 18:28
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webproc COMM_MakeCustomMsg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18454.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-536/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:o:dlink:dap-1360_firmware:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360_firmware", vendor: "dlink", versions: [ { lessThanOrEqual: "v6.14b01", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-32144", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-06-05T17:21:00.390076Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-05T17:22:52.418Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.178Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-536", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-536/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T15:16:42.977-05:00", datePublic: "2023-05-04T17:15:31.164-05:00", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webproc COMM_MakeCustomMsg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18454.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121: Stack-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:12.699Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-536", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-536/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webproc COMM_MakeCustomMsg Stack-based Buffer Overflow Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32144", datePublished: "2024-05-03T01:56:30.085Z", dateReserved: "2023-05-03T20:10:47.059Z", dateUpdated: "2024-09-18T18:28:12.699Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-0717
Vulnerability from cvelistv5
Published
2024-01-19 15:31
Modified
2024-08-01 18:11
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS score ?
Summary
A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1, DIR-841, DIR-842, DIR-842S, DIR-843, DIR-853, DIR-878, DIR-882, DIR-1210, DIR-1260, DIR-2150, DIR-X1530, DIR-X1860, DSL-224, DSL-245GR, DSL-2640U, DSL-2750U, DSL-G2452GR, DVG-5402G, DVG-5402G, DVG-5402GFRU, DVG-N5402G, DVG-N5402G-IL, DWM-312W, DWM-321, DWR-921, DWR-953 and Good Line Router v2 up to 20240112. This vulnerability affects unknown code of the file /devinfo of the component HTTP GET Request Handler. The manipulation of the argument area with the input notice|net|version leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251542 is the identifier assigned to this vulnerability.
References
| ▼ | URL | Tags |
|---|---|---|
| https://vuldb.com/?id.251542 | vdb-entry, technical-description | |
| https://vuldb.com/?ctiid.251542 | signature, permissions-required | |
| https://github.com/999zzzzz/D-Link | exploit |
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | D-Link | DAP-1360 |
Version: 20240112 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-01T18:11:35.784Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "vdb-entry", "technical-description", "x_transferred", ], url: "https://vuldb.com/?id.251542", }, { tags: [ "signature", "permissions-required", "x_transferred", ], url: "https://vuldb.com/?ctiid.251542", }, { tags: [ "exploit", "x_transferred", ], url: "https://github.com/999zzzzz/D-Link", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { modules: [ "HTTP GET Request Handler", ], product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-300", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-615", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-615GF", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-615S", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-615T", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-620", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-620S", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-806A", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-815", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-815AC", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-815S", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-816", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-820", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-822", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-825", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-825AC", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-825ACF", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-825ACG1", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-841", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-842", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-842S", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-843", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-853", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-878", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-882", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-1210", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-1260", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-2150", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-X1530", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DIR-X1860", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DSL-224", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DSL-245GR", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DSL-2640U", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DSL-2750U", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DSL-G2452GR", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DVG-5402G", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DVG-5402G", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DVG-5402GFRU", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DVG-N5402G", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DVG-N5402G-IL", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DWM-312W", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DWM-321", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DWR-921", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "DWR-953", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, { modules: [ "HTTP GET Request Handler", ], product: "Good Line Router v2", vendor: "D-Link", versions: [ { status: "affected", version: "20240112", }, ], }, ], credits: [ { lang: "en", type: "reporter", value: "99iz (VulDB User)", }, ], descriptions: [ { lang: "en", value: "A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1, DIR-841, DIR-842, DIR-842S, DIR-843, DIR-853, DIR-878, DIR-882, DIR-1210, DIR-1260, DIR-2150, DIR-X1530, DIR-X1860, DSL-224, DSL-245GR, DSL-2640U, DSL-2750U, DSL-G2452GR, DVG-5402G, DVG-5402G, DVG-5402GFRU, DVG-N5402G, DVG-N5402G-IL, DWM-312W, DWM-321, DWR-921, DWR-953 and Good Line Router v2 up to 20240112. This vulnerability affects unknown code of the file /devinfo of the component HTTP GET Request Handler. The manipulation of the argument area with the input notice|net|version leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251542 is the identifier assigned to this vulnerability.", }, { lang: "de", value: "In D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1, DIR-841, DIR-842, DIR-842S, DIR-843, DIR-853, DIR-878, DIR-882, DIR-1210, DIR-1260, DIR-2150, DIR-X1530, DIR-X1860, DSL-224, DSL-245GR, DSL-2640U, DSL-2750U, DSL-G2452GR, DVG-5402G, DVG-5402G, DVG-5402GFRU, DVG-N5402G, DVG-N5402G-IL, DWM-312W, DWM-321, DWR-921, DWR-953 and Good Line Router v2 bis 20240112 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Datei /devinfo der Komponente HTTP GET Request Handler. Mittels dem Manipulieren des Arguments area mit der Eingabe notice|net|version mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.", }, ], metrics: [ { cvssV3_1: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, }, { cvssV3_0: { baseScore: 5.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, }, { cvssV2_0: { baseScore: 5, vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N", version: "2.0", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-200", description: "CWE-200 Information Disclosure", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-01-19T15:31:04.290Z", orgId: "1af790b2-7ee1-4545-860a-a788eba489b5", shortName: "VulDB", }, references: [ { tags: [ "vdb-entry", "technical-description", ], url: "https://vuldb.com/?id.251542", }, { tags: [ "signature", "permissions-required", ], url: "https://vuldb.com/?ctiid.251542", }, { tags: [ "exploit", ], url: "https://github.com/999zzzzz/D-Link", }, ], timeline: [ { lang: "en", time: "2024-01-19T00:00:00.000Z", value: "Advisory disclosed", }, { lang: "en", time: "2024-01-19T01:00:00.000Z", value: "VulDB entry created", }, { lang: "en", time: "2024-01-19T08:26:48.000Z", value: "VulDB entry last update", }, ], title: "D-Link Good Line Router v2 HTTP GET Request devinfo information disclosure", }, }, cveMetadata: { assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5", assignerShortName: "VulDB", cveId: "CVE-2024-0717", datePublished: "2024-01-19T15:31:04.290Z", dateReserved: "2024-01-19T07:21:32.386Z", dateUpdated: "2024-08-01T18:11:35.784Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32138
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2024-09-18 18:28
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18416.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-530/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:d-link:dap-1360:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360", vendor: "d-link", versions: [ { status: "affected", version: "-", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-32138", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-16T17:35:00.512734Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-04T17:26:06.642Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.270Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-530", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-530/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T15:16:42.940-05:00", datePublic: "2023-05-04T17:14:43.040-05:00", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18416.", }, ], metrics: [ { cvssV3_0: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-122", description: "CWE-122: Heap-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:08.264Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-530", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-530/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32138", datePublished: "2024-05-03T01:56:25.440Z", dateReserved: "2023-05-03T20:10:47.058Z", dateUpdated: "2024-09-18T18:28:08.264Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32145
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2024-09-18 18:28
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the processing of login requests to the web-based user interface. The firmware contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-18455.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-537/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:d-link:dap-1360:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360", vendor: "d-link", versions: [ { lessThanOrEqual: "v6.14b01", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-32145", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-03T17:18:28.056019Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-04T17:26:13.942Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.212Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-537", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-537/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T15:16:42.983-05:00", datePublic: "2023-05-04T17:15:41.674-05:00", descriptions: [ { lang: "en", value: "D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the processing of login requests to the web-based user interface. The firmware contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication on the system.\n. Was ZDI-CAN-18455.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-259", description: "CWE-259: Use of Hard-coded Password", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:13.398Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-537", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-537/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 Hardcoded Credentials Authentication Bypass Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32145", datePublished: "2024-05-03T01:56:30.792Z", dateReserved: "2023-05-03T20:10:47.059Z", dateUpdated: "2024-09-18T18:28:13.398Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32142
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2024-09-18 18:28
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webproc var:page Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. When parsing the var:page parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18422.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-534/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:d-link:dap-1360f1_firmware:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360f1_firmware", vendor: "d-link", versions: [ { status: "affected", version: "R.47.0.0 AutoCAD 2021", }, { status: "affected", version: "R.47.0.0 AutoCAD LT 2021", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-32142", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-06-11T17:31:28.943059Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-11T17:46:15.813Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.227Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-534", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-534/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T15:16:42.965-05:00", datePublic: "2023-05-04T17:15:20.106-05:00", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webproc var:page Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. When parsing the var:page parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18422.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121: Stack-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:11.192Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-534", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-534/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webproc var:page Stack-based Buffer Overflow Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32142", datePublished: "2024-05-03T01:56:28.550Z", dateReserved: "2023-05-03T20:10:47.059Z", dateUpdated: "2024-09-18T18:28:11.192Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32137
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2024-09-18 18:28
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root.
. Was ZDI-CAN-18415.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-529/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:h:d-link:dap-1360f1_firmware:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360f1_firmware", vendor: "d-link", versions: [ { lessThanOrEqual: "6.14b01", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:h:d-link:dap-2020_firmware:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-2020_firmware", vendor: "d-link", versions: [ { lessThanOrEqual: "1.03b01", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-32137", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-06-06T15:02:05.102361Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-06T15:10:19.566Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:29.167Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-529", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-529/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T15:16:42.934-05:00", datePublic: "2023-05-04T17:14:37.774-05:00", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of requests to the /cgi-bin/webproc endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of root.\n. Was ZDI-CAN-18415.", }, ], metrics: [ { cvssV3_0: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-22", description: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:07.536Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-529", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-529/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32137", datePublished: "2024-05-03T01:56:24.719Z", dateReserved: "2023-05-03T20:10:47.058Z", dateUpdated: "2024-09-18T18:28:07.536Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-32136
Vulnerability from cvelistv5
Published
2024-05-03 01:56
Modified
2024-09-18 18:28
Severity ?
EPSS score ?
Summary
D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. When parsing the var:menu parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-18414.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-528/ | x_research-advisory | |
| https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324 | vendor-advisory |
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:o:dlink:dap-1360_firmware:-:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "dap-1360_firmware", vendor: "dlink", versions: [ { lessThanOrEqual: "v6.14b01", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2023-32136", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-06-05T17:24:50.381888Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-05T17:25:13.064Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-08-02T15:03:28.985Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "ZDI-23-528", tags: [ "x_research-advisory", "x_transferred", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-528/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", "x_transferred", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "DAP-1360", vendor: "D-Link", versions: [ { status: "affected", version: "6.14B01 EU HOTFIX", }, ], }, ], dateAssigned: "2023-05-03T15:16:42.928-05:00", datePublic: "2023-05-04T17:14:31.219-05:00", descriptions: [ { lang: "en", value: "D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. When parsing the var:menu parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-18414.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "CWE-121: Stack-based Buffer Overflow", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-18T18:28:06.807Z", orgId: "99f1926a-a320-47d8-bbb5-42feb611262e", shortName: "zdi", }, references: [ { name: "ZDI-23-528", tags: [ "x_research-advisory", ], url: "https://www.zerodayinitiative.com/advisories/ZDI-23-528/", }, { name: "vendor-provided URL", tags: [ "vendor-advisory", ], url: "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10324", }, ], source: { lang: "en", value: "Anonymous", }, title: "D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability", }, }, cveMetadata: { assignerOrgId: "99f1926a-a320-47d8-bbb5-42feb611262e", assignerShortName: "zdi", cveId: "CVE-2023-32136", datePublished: "2024-05-03T01:56:24.020Z", dateReserved: "2023-05-03T20:10:47.058Z", dateUpdated: "2024-09-18T18:28:06.807Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }