386 lines
15 KiB
JSON
386 lines
15 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-6044",
|
||
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "twcert",
|
||
"dateReserved": "2024-06-17T01:58:48.367Z",
|
||
"datePublished": "2024-06-17T02:30:04.564Z",
|
||
"dateUpdated": "2024-08-01T21:25:03.216Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "G403",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "G415",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "G416",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "M18",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R03",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R04",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R12",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R18",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "E30",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "M30",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "M32",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "M60",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R32",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "E15",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.20.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R15",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.20.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL."
|
||
}
|
||
],
|
||
"value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL."
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-126",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-126 Path Traversal"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "ADJACENT_NETWORK",
|
||
"availabilityImpact": "NONE",
|
||
"baseScore": 6.5,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "NONE",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-22",
|
||
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
|
||
"shortName": "twcert",
|
||
"dateUpdated": "2024-06-17T02:30:04.564Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"third-party-advisory"
|
||
],
|
||
"url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"third-party-advisory"
|
||
],
|
||
"url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Please update firmware of following models to 1.10.01 or later version：<br>G403, G415, G416, M18, R03, R04, R12, R18<br><br>Please update firmware of following models to 1.10.02 or later version：<br>E30, M30, M32, M60, R32<br><br>Please update firmware of following models to 1.20.01 or later version：<br>E15, R15<br>"
|
||
}
|
||
],
|
||
"value": "Please update firmware of following models to 1.10.01 or later version：\nG403, G415, G416, M18, R03, R04, R12, R18\n\nPlease update firmware of following models to 1.10.02 or later version：\nE30, M30, M32, M60, R32\n\nPlease update firmware of following models to 1.20.01 or later version：\nE15, R15"
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "TVN-202406012",
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "D-Link router - Arbitrary File Reading",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-06-18T14:25:27.426937Z",
|
||
"id": "CVE-2024-6044",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-18T14:25:43.368Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-01T21:25:03.216Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"third-party-advisory",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"third-party-advisory",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |