Back

CVE-2024-5294

May 23, 2024, 10:15 p.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

D-Link DIR-3040 router

Source

zdi-disclosures@trendmicro.com

Tags

zdi-disclosures@trendmicro.com
CWE-401
2024-05-23
CVE-2024-5294

CVE-2024-5294 details

Published : May 23, 2024, 10:15 p.m.
Last Modified : May 23, 2024, 10:15 p.m.

Description

D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on ports 80 and 443. The issue results from the lack of proper memory management when processing HTTP cookie values. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. . Was ZDI-CAN-21668.

CVSS Score

1 2 3 4.3 5 6 7 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

Base Score

4.3

Exploitability Score

Impact Score

Base Severity

MEDIUM

Vector String : CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

URL Source
https://www.zerodayinitiative.com/advisories/ZDI-24-445/ zdi-disclosures@trendmicro.com
This website uses the NVD API, but is not approved or certified by it.