cve-2024-8130
Vulnerability from cvelistv5
Published
2024-08-24 16:31
Modified
2024-08-26 16:24
Severity ?
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Summary
D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3 command injection
References
cna@vuldb.comhttps://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_s3.mdExploit, Third Party Advisory
cna@vuldb.comhttps://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383Vendor Advisory
cna@vuldb.comhttps://vuldb.com/?ctiid.275701Permissions Required, VDB Entry
cna@vuldb.comhttps://vuldb.com/?id.275701Third Party Advisory, VDB Entry
cna@vuldb.comhttps://vuldb.com/?submit.396291Third Party Advisory, VDB Entry
cna@vuldb.comhttps://www.dlink.com/Product
Impacted products
D-LinkDNS-120
D-LinkDNR-202L
D-LinkDNS-315L
D-LinkDNS-320
D-LinkDNS-320L
D-LinkDNS-320LW
D-LinkDNS-321
D-LinkDNR-322L
D-LinkDNS-323
D-LinkDNS-325
D-LinkDNS-326
D-LinkDNS-327L
D-LinkDNR-326
D-LinkDNS-340L
D-LinkDNS-343
D-LinkDNS-345
D-LinkDNS-726-4
D-LinkDNS-1100-4
D-LinkDNS-1200-05
D-LinkDNS-1550-04
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-120:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-120",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-315l:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-315l",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dnr-202l:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dnr-202l",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-320:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-320",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-320l:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-320l",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-320lw:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-320lw",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-323:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-323",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-321:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-321",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-325:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-325",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dnr-322l:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dnr-322l",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-326:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-326",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-327l:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-327l",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dnr-326:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dnr-326",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-340l:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-340l",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-343:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-343",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-345:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-345",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-726-4:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-726-4",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-1100-4:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-1100-4",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-1200-05:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-1200-05",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:d-link:dns-1550-04:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dns-1550-04",
            "vendor": "d-link",
            "versions": [
              {
                "status": "affected",
                "version": "20240814"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8130",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-26T15:29:57.547304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T16:24:18.306Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-120",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNR-202L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-315L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-320",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-320L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-320LW",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-321",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNR-322L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-323",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-325",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-326",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-327L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNR-326",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-340L",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-343",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-345",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-726-4",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-1100-4",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-1200-05",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        },
        {
          "modules": [
            "HTTP POST Request Handler"
          ],
          "product": "DNS-1550-04",
          "vendor": "D-Link",
          "versions": [
            {
              "status": "affected",
              "version": "20240814"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Buaa1otTeam (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this vulnerability is the function cgi_s3 of the file /cgi-bin/s3.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_a_key leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced."
        },
        {
          "lang": "de",
          "value": "In D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 bis 20240814 wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Das betrifft die Funktion cgi_s3 der Datei /cgi-bin/s3.cgi der Komponente HTTP POST Request Handler. Durch Manipulieren des Arguments f_a_key mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-24T16:31:05.950Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-275701 | D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3 command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.275701"
        },
        {
          "name": "VDB-275701 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.275701"
        },
        {
          "name": "Submit #396291 | D-Link DNS 320/320L/321/323/325/327L Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.396291"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_s3.md"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.dlink.com/"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-08-23T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2024-08-23T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2024-08-23T20:35:15.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3 command injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-8130",
    "datePublished": "2024-08-24T16:31:05.950Z",
    "dateReserved": "2024-08-23T18:29:55.401Z",
    "dateUpdated": "2024-08-26T16:24:18.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-8130\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2024-08-24T17:15:03.290\",\"lastModified\":\"2024-08-27T15:34:08.287\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[{\"sourceIdentifier\":\"cna@vuldb.com\",\"tags\":[\"unsupported-when-assigned\"]}],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this vulnerability is the function cgi_s3 of the file /cgi-bin/s3.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_a_key leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.\"},{\"lang\":\"es\",\"value\":\"Se ha encontrado una vulnerabilidad en D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS -326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 y DNS-1550-04 hasta 20240814 y clasificada como cr\u00edtica. La funci\u00f3n cgi_s3 del archivo /cgi-bin/s3.cgi del componente HTTP POST Request Handler es afectada por esta vulnerabilidad. La manipulaci\u00f3n del argumento f_a_key conduce a la inyecci\u00f3n de comandos. El ataque se puede lanzar de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el fabricante. NOTA: Se contact\u00f3 primeramente con el proveedor y se confirm\u00f3 que el producto ha llegado al final de su vida \u00fatil. Deber\u00eda retirarse y reemplazarse.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"LOW\",\"vulnerableSystemIntegrity\":\"LOW\",\"vulnerableSystemAvailability\":\"LOW\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NOT_DEFINED\",\"recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.5},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]},{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-1550-04_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2C1EF70-AD9B-48D7-8DF6-A6416C517F12\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E691E775-382C-4BA9-AA44-FBC3148D3E54\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-1200-05_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42DA6DEB-3578-44A5-916F-1628141F0DDE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D042C75D-6731-46B2-B11E-A009B9029B3F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-1100-4_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CAFE1E3-B705-4CF1-AEB9-A474432B6D34\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5D08ED7-3E7F-4D30-890E-6535F6C34682\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-726-4_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A74D270-9076-474D-A06F-C915FCEA2164\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75E5010F-21BA-4B6B-B00C-2688268FD67B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-345_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12C5E2D7-018E-4ED1-92C7-B5B1D8CC6990\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7E56821-7EA0-4CA1-BA17-7FD4ED9F794C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-343_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD656642-EDD4-4EB2-81AB-04207BC14196\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F968791D-D3BD-442C-818E-4E878B12776D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-340l_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39FF9666-8493-4A36-A199-1190AD8FAF3D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0646B20C-5642-4CEA-A96C-7E82AD94A281\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dnr-326_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"816E5F34-CE76-49E5-91F3-8CC84C561558\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33CB308B-CF82-4E40-B2DC-23EBD48CD130\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-327l_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"172D5EFF-E0DF-4A99-8499-71450A46A86C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB305B29-7F89-4A52-9ECF-3DB0BDD2350D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-326_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5E6F048-D865-4378-87C7-B0E528134276\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26F4F77-A6E3-4D7D-A781-BEB5FF7BC44F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-325_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16954393-3449-438A-978C-265EE3A35FF8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8042169D-D9FA-4BD6-90D1-E0DE269E42B9\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-323_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"641CB5F1-3DE0-480B-95A4-FC42A8FF3C97\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94ED678A-AB4C-4637-B0D8-C232A0BB5D5F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dnr-322l_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD3AD5EE-8E1E-4336-A1AB-AB028CC71286\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DAF62A4-2429-4B89-8FAD-8B23EF15E050\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-321_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC28053F-88A9-4CA1-A2A2-CC90FEEA68FC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A278BC9-6197-43D9-93C2-3DF760856FB7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-320lw_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8FE78C5B-2A98-47EE-BF67-CF58AFE50A37\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"45467ABC-BAA9-4EB0-9F97-92E31854CA8B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-320l_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4599D769-0210-4D49-9896-9AD1376A037E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6C677E53-6885-4EC4-A7CC-E24E8F445F59\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-320_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4452F9A4-3A0A-4773-9818-04C94CF9F8E7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0F5355E-F68D-49FE-9793-1FD9BD9AF3E1\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-315l_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8CFCD7B-EFFB-4FAB-9537-46AC7B567126\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"03C5CED7-55A7-4026-95CD-A2ADB5853823\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dnr-202l_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96195649-172A-4C21-AA15-7B05F86C5CEC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07A92F2C-16FD-4A53-8066-83FEC2818DF5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:dlink:dns-120_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C44BE2C6-BF3E-43C3-B32F-2DCE756F94BC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E161E54-2FE9-4359-9B2D-8700D00DE8E7\"}]}]}],\"references\":[{\"url\":\"https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_s3.md\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://vuldb.com/?ctiid.275701\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Permissions Required\",\"VDB Entry\"]},{\"url\":\"https://vuldb.com/?id.275701\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://vuldb.com/?submit.396291\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.dlink.com/\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Product\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.