VAR-200406-0054
Vulnerability from variot - Updated: 2022-05-04 09:53The D-Link DI-614 + SOHO router running in firmware 2.30 and the DI-704 SOHO router running in firmware 2.60B2 have vulnerabilities that could allow remote attackers to inject arbitrary scripts or HTML programs using the DHCP HOSTNAM option requested by DHCP. It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log. An attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device. The injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible. Although only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200406-0054",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "dl-704 b2",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.60"
},
{
"model": "dl-704 b6",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.56"
},
{
"model": "dl-704 b5",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.56"
},
{
"model": "di-624 soho router",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "1.28"
},
{
"model": "di-614+",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.18"
},
{
"model": "di-614+",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.10"
},
{
"model": "di-614+ f",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.0"
},
{
"model": "di-614+ 3g",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.0"
},
{
"model": "di-614+",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.03"
},
{
"model": "di-614+",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "2.0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1751"
},
{
"db": "BID",
"id": "10587"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "c3rb3r \u003cc3rb3r@sympatico.ca\u003e originally disclosed this vulnerability.",
"sources": [
{
"db": "BID",
"id": "10587"
}
],
"trust": 0.3
},
"cve": "CAN-2004-0615",
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The D-Link DI-614 + SOHO router running in firmware 2.30 and the DI-704 SOHO router running in firmware 2.60B2 have vulnerabilities that could allow remote attackers to inject arbitrary scripts or HTML programs using the DHCP HOSTNAM option requested by DHCP. It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log. \nAn attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device. \nThe injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible. \nAlthough only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1751"
},
{
"db": "BID",
"id": "10587"
}
],
"trust": 0.81
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "10587",
"trust": 0.9
},
{
"db": "CNCVE",
"id": "CNCVE-20040615",
"trust": 0.6
},
{
"db": "XF",
"id": "16468",
"trust": 0.6
},
{
"db": "NVD",
"id": "CAN-2004-0615",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2004-1751",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1751"
},
{
"db": "BID",
"id": "10587"
}
]
},
"id": "VAR-200406-0054",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1751"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1751"
}
]
},
"last_update_date": "2022-05-04T09:53:06.084000Z",
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 0.6,
"url": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=can-2004-0615"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/10587/solution/"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/16468"
},
{
"trust": 0.3,
"url": "http://www.d-link.com/"
},
{
"trust": 0.3,
"url": "/archive/1/366615"
},
{
"trust": 0.3,
"url": "/archive/1/367855"
},
{
"trust": 0.3,
"url": "/archive/1/366826"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1751"
},
{
"db": "BID",
"id": "10587"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2004-1751"
},
{
"db": "BID",
"id": "10587"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-06-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2004-1751"
},
{
"date": "2004-06-21T00:00:00",
"db": "BID",
"id": "10587"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-06-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2004-1751"
},
{
"date": "2004-06-21T00:00:00",
"db": "BID",
"id": "10587"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "10587"
}
],
"trust": 0.3
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "CNVD-2004-1751",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2004-1751"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input Validation Error",
"sources": [
{
"db": "BID",
"id": "10587"
}
],
"trust": 0.3
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…