cvelistv5 - cve-2024-6044

CVE-2024-6044 (GCVE-0-2024-6044)

Vulnerability from cvelistv5 – Published: 2024-06-17 02:30 – Updated: 2024-08-01 21:25

Title

D-Link router - Arbitrary File Reading

Summary

Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

twcert

References

URL

Tags

	https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html	third-party-advisory
	https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html	third-party-advisory
	https://supportannouncement.us.dlink.com/security…	vendor-advisory

Impacted products

Vendor

Product

Version

D-Link

G403

Affected: earlier , < 1.10.01 (custom)

D-Link	G415	Affected: earlier , < 1.10.01 (custom)
D-Link	G416	Affected: earlier , < 1.10.01 (custom)
D-Link	M18	Affected: earlier , < 1.10.01 (custom)
D-Link	R03	Affected: earlier , < 1.10.01 (custom)
D-Link	R04	Affected: earlier , < 1.10.01 (custom)
D-Link	R12	Affected: earlier , < 1.10.01 (custom)
D-Link	R18	Affected: earlier , < 1.10.01 (custom)
D-Link	E30	Affected: earlier , < 1.10.02 (custom)
D-Link	M30	Affected: earlier , < 1.10.02 (custom)
D-Link	M32	Affected: earlier , < 1.10.02 (custom)
D-Link	M60	Affected: earlier , < 1.10.02 (custom)
D-Link	R32	Affected: earlier , < 1.10.02 (custom)
D-Link	E15	Affected: earlier , < 1.20.01 (custom)
D-Link	R15	Affected: earlier , < 1.20.01 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6044",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T14:25:27.426937Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T14:25:43.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:25:03.216Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"
          },
          {
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "G403",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "G415",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "G416",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "M18",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "R03",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "R04",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "R12",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "R18",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "E30",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.02",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "M30",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.02",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "M32",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.02",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "M60",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.02",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "R32",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.10.02",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "E15",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.20.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "R15",
          "vendor": "D-Link",
          "versions": [
            {
              "lessThan": "1.20.01",
              "status": "affected",
              "version": "earlier",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL."
            }
          ],
          "value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-17T02:30:04.564Z",
        "orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
        "shortName": "twcert"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Please update firmware of following models to 1.10.01 or later version\uff1a\u003cbr\u003eG403, G415, G416, M18, R03, R04, R12, R18\u003cbr\u003e\u003cbr\u003ePlease update firmware of following models to 1.10.02 or later version\uff1a\u003cbr\u003eE30, M30, M32, M60, R32\u003cbr\u003e\u003cbr\u003ePlease update firmware of following models to 1.20.01 or later version\uff1a\u003cbr\u003eE15, R15\u003cbr\u003e"
            }
          ],
          "value": "Please update firmware of following models to 1.10.01 or later version\uff1a\nG403, G415, G416, M18, R03, R04, R12, R18\n\nPlease update firmware of following models to 1.10.02 or later version\uff1a\nE30, M30, M32, M60, R32\n\nPlease update firmware of following models to 1.20.01 or later version\uff1a\nE15, R15"
        }
      ],
      "source": {
        "advisory": "TVN-202406012",
        "discovery": "EXTERNAL"
      },
      "title": "D-Link router - Arbitrary File Reading",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
    "assignerShortName": "twcert",
    "cveId": "CVE-2024-6044",
    "datePublished": "2024-06-17T02:30:04.564Z",
    "dateReserved": "2024-06-17T01:58:48.367Z",
    "dateUpdated": "2024-08-01T21:25:03.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.\"}, {\"lang\": \"es\", \"value\": \"Ciertos modelos de enrutadores inal\\u00e1mbricos D-Link tienen una vulnerabilidad de path traversal. Los atacantes no autenticados en la misma red de \\u00e1rea local pueden leer archivos arbitrarios del sistema manipulando la URL.\"}]",
      "id": "CVE-2024-6044",
      "lastModified": "2024-11-21T09:48:49.963",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"twcert@cert.org.tw\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2024-06-17T03:15:09.163",
      "references": "[{\"url\": \"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398\", \"source\": \"twcert@cert.org.tw\"}, {\"url\": \"https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html\", \"source\": \"twcert@cert.org.tw\"}, {\"url\": \"https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html\", \"source\": \"twcert@cert.org.tw\"}, {\"url\": \"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "twcert@cert.org.tw",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"twcert@cert.org.tw\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-6044\",\"sourceIdentifier\":\"twcert@cert.org.tw\",\"published\":\"2024-06-17T03:15:09.163\",\"lastModified\":\"2024-11-21T09:48:49.963\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.\"},{\"lang\":\"es\",\"value\":\"Ciertos modelos de enrutadores inal\u00e1mbricos D-Link tienen una vulnerabilidad de path traversal. Los atacantes no autenticados en la misma red de \u00e1rea local pueden leer archivos arbitrarios del sistema manipulando la URL.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398\",\"source\":\"twcert@cert.org.tw\"},{\"url\":\"https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html\",\"source\":\"twcert@cert.org.tw\"},{\"url\":\"https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html\",\"source\":\"twcert@cert.org.tw\"},{\"url\":\"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html\", \"tags\": [\"third-party-advisory\", \"x_transferred\"]}, {\"url\": \"https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html\", \"tags\": [\"third-party-advisory\", \"x_transferred\"]}, {\"url\": \"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T21:25:03.216Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-6044\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-18T14:25:27.426937Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-18T14:25:40.312Z\"}}], \"cna\": {\"title\": \"D-Link router - Arbitrary File Reading\", \"source\": {\"advisory\": \"TVN-202406012\", \"discovery\": \"EXTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-126\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-126 Path Traversal\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"D-Link\", \"product\": \"G403\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"G415\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"G416\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"M18\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"R03\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"R04\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"R12\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"R18\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"E30\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"M30\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"M32\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"M60\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"R32\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.10.02\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"E15\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.20.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"D-Link\", \"product\": \"R15\", \"versions\": [{\"status\": \"affected\", \"version\": \"earlier\", \"lessThan\": \"1.20.01\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Please update firmware of following models to 1.10.01 or later version\\uff1a\\nG403, G415, G416, M18, R03, R04, R12, R18\\n\\nPlease update firmware of following models to 1.10.02 or later version\\uff1a\\nE30, M30, M32, M60, R32\\n\\nPlease update firmware of following models to 1.20.01 or later version\\uff1a\\nE15, R15\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Please update firmware of following models to 1.10.01 or later version\\uff1a\u003cbr\u003eG403, G415, G416, M18, R03, R04, R12, R18\u003cbr\u003e\u003cbr\u003ePlease update firmware of following models to 1.10.02 or later version\\uff1a\u003cbr\u003eE30, M30, M32, M60, R32\u003cbr\u003e\u003cbr\u003ePlease update firmware of following models to 1.20.01 or later version\\uff1a\u003cbr\u003eE15, R15\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e\", \"shortName\": \"twcert\", \"dateUpdated\": \"2024-06-17T02:30:04.564Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-6044\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-01T21:25:03.216Z\", \"dateReserved\": \"2024-06-17T01:58:48.367Z\", \"assignerOrgId\": \"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e\", \"datePublished\": \"2024-06-17T02:30:04.564Z\", \"assignerShortName\": \"twcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-6044

Vulnerability from fkie_nvd - Published: 2024-06-17 03:15 - Updated: 2024-11-21 09:48

Severity ?

6.5 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.

References

	URL	Tags
	twcert@cert.org.tw	https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398
	twcert@cert.org.tw	https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html
	twcert@cert.org.tw	https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html
	af854a3a-2127-422b-91ae-364da2661108	https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398
	af854a3a-2127-422b-91ae-364da2661108	https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html
	af854a3a-2127-422b-91ae-364da2661108	https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL."
    },
    {
      "lang": "es",
      "value": "Ciertos modelos de enrutadores inal\u00e1mbricos D-Link tienen una vulnerabilidad de path traversal. Los atacantes no autenticados en la misma red de \u00e1rea local pueden leer archivos arbitrarios del sistema manipulando la URL."
    }
  ],
  "id": "CVE-2024-6044",
  "lastModified": "2024-11-21T09:48:49.963",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "twcert@cert.org.tw",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-06-17T03:15:09.163",
  "references": [
    {
      "source": "twcert@cert.org.tw",
      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
    },
    {
      "source": "twcert@cert.org.tw",
      "url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"
    },
    {
      "source": "twcert@cert.org.tw",
      "url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "twcert@cert.org.tw",
      "type": "Secondary"
    }
  ]
}

WID-SEC-W-2024-1391

Vulnerability from csaf_certbund - Published: 2024-06-16 22:00 - Updated: 2024-06-16 22:00

Summary

D-LINK Wireless Router: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Router der Firma D-LINK enthalten eine Firewall und in der Regel eine WLAN-Schnittstelle. Die Geräte sind hauptsächlich für private Anwender und Kleinunternehmen konzipiert.

Angriff

Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in D-LINK Wireless Routern ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme

- BIOS/Firmware

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Router der Firma D-LINK enthalten eine Firewall und in der Regel eine WLAN-Schnittstelle. Die Ger\u00e4te sind haupts\u00e4chlich f\u00fcr private Anwender und Kleinunternehmen konzipiert.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in D-LINK Wireless Routern ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- BIOS/Firmware",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1391 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1391.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1391 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1391"
      },
      {
        "category": "external",
        "summary": "D-Link Support Announcement vom 2024-06-16",
        "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
      },
      {
        "category": "external",
        "summary": "NIST Vulnerability Database vom 2024-06-16",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6044"
      },
      {
        "category": "external",
        "summary": "NIST Vulnerability Database vom 2024-06-16",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6045"
      },
      {
        "category": "external",
        "summary": "GitHub Advisory Database vom 2024-06-16",
        "url": "https://github.com/advisories/GHSA-rr4p-qrv5-g999"
      }
    ],
    "source_lang": "en-US",
    "title": "D-LINK Wireless Router: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-06-16T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:10:15.066+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-1391",
      "initial_release_date": "2024-06-16T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-06-16T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "D-LINK Router",
            "product": {
              "name": "D-LINK Router",
              "product_id": "T035432",
              "product_identification_helper": {
                "cpe": "cpe:/h:d-link:router:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "D-LINK"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-6044",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in der Firmware verschiedener D-LINK Router, die es erm\u00f6glichen, beliebige Dateien zu lesen oder sich mit fest codierten Zugangsdaten \u00fcber Telnet anzumelden. Ein Angreifer aus einem angrenzenden Netzwerk kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035432"
        ]
      },
      "release_date": "2024-06-16T22:00:00.000+00:00",
      "title": "CVE-2024-6044"
    },
    {
      "cve": "CVE-2024-6045",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in der Firmware verschiedener D-LINK Router, die es erm\u00f6glichen, beliebige Dateien zu lesen oder sich mit fest codierten Zugangsdaten \u00fcber Telnet anzumelden. Ein Angreifer aus einem angrenzenden Netzwerk kann diese Schwachstellen ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen oder um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035432"
        ]
      },
      "release_date": "2024-06-16T22:00:00.000+00:00",
      "title": "CVE-2024-6045"
    }
  ]
}

GHSA-RR4P-QRV5-G999

Vulnerability from github – Published: 2024-06-17 03:31 – Updated: 2024-06-17 03:31

Details

Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-6044"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-17T03:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.",
  "id": "GHSA-rr4p-qrv5-g999",
  "modified": "2024-06-17T03:31:07Z",
  "published": "2024-06-17T03:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6044"
    },
    {
      "type": "WEB",
      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-6044 (GCVE-0-2024-6044)

FKIE_CVE-2024-6044

WID-SEC-W-2024-1391

GHSA-RR4P-QRV5-G999

Tags

Sightings

Nomenclature