Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-8131

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function module_enable_disable of the file /cgi-bin/apkg_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_module_name leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Published

2024-08-24T18:15:04.420

Last Modified

2024-08-27T15:34:36.710

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-77
  • Type: Primary
    CWE-78
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System dlink dns-1550-04_firmware - Yes
Hardware dlink dns-1550-04 - No
Operating System dlink dns-1200-05_firmware - Yes
Hardware dlink dns-1200-05 - No
Operating System dlink dns-1100-4_firmware - Yes
Hardware dlink dns-1100-4 - No
Operating System dlink dns-726-4_firmware - Yes
Hardware dlink dns-726-4 - No
Operating System dlink dns-345_firmware - Yes
Hardware dlink dns-345 - No
Operating System dlink dns-343_firmware - Yes
Hardware dlink dns-343 - No
Operating System dlink dns-340l_firmware - Yes
Hardware dlink dns-340l - No
Operating System dlink dnr-326_firmware - Yes
Hardware dlink dnr-326 - No
Operating System dlink dns-327l_firmware - Yes
Hardware dlink dns-327l - No
Operating System dlink dns-326_firmware - Yes
Hardware dlink dns-326 - No
Operating System dlink dns-325_firmware - Yes
Hardware dlink dns-325 - No
Operating System dlink dns-323_firmware - Yes
Hardware dlink dns-323 - No
Operating System dlink dnr-322l_firmware - Yes
Hardware dlink dnr-322l - No
Operating System dlink dns-321_firmware - Yes
Hardware dlink dns-321 - No
Operating System dlink dns-320lw_firmware - Yes
Hardware dlink dns-320lw - No
Operating System dlink dns-320l_firmware - Yes
Hardware dlink dns-320l - No
Operating System dlink dns-320_firmware - Yes
Hardware dlink dns-320 - No
Operating System dlink dns-315l_firmware - Yes
Hardware dlink dns-315l - No
Operating System dlink dnr-202l_firmware - Yes
Hardware dlink dnr-202l - No
Operating System dlink dns-120_firmware - Yes
Hardware dlink dns-120 - No
References