459 lines
18 KiB
JSON
459 lines
18 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-6045",
|
||
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "twcert",
|
||
"dateReserved": "2024-06-17T01:58:49.676Z",
|
||
"datePublished": "2024-06-17T03:12:14.137Z",
|
||
"dateUpdated": "2024-08-01T21:25:03.244Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "G403",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "G415",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "G416",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "M18",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R03",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R04",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R12",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R18",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "E30",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "M30",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "M32",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "M60",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R32",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.10.02",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "E15",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.20.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "R15",
|
||
"vendor": "D-Link",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.20.01",
|
||
"status": "affected",
|
||
"version": "earlier",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"datePublic": "2024-06-17T03:12:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware."
|
||
}
|
||
],
|
||
"value": "Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware."
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-190",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-190 Reverse Engineer an Executable to Expose Assumed Hidden Functionality"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "ADJACENT_NETWORK",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 8.8,
|
||
"baseSeverity": "HIGH",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-912",
|
||
"description": "CWE-912: Hidden Functionality",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-798",
|
||
"description": "CWE-798: Use of Hard-coded Credentials",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
|
||
"shortName": "twcert",
|
||
"dateUpdated": "2024-06-17T03:12:14.137Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"third-party-advisory"
|
||
],
|
||
"url": "https://www.twcert.org.tw/tw/cp-132-7879-da630-1.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"third-party-advisory"
|
||
],
|
||
"url": "https://www.twcert.org.tw/en/cp-139-7880-629f5-2.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "Please update firmware of following models to 1.10.01 or later version：<br>G403, G415, G416, M18, R03, R04, R12, R18<br><br>Please update firmware of following models to 1.10.02 or later version： <br>E30, M30, M32, M60, R32<br><br>Please update firmware of following models to 1.20.01 or later version：<br>E15, R15<br>"
|
||
}
|
||
],
|
||
"value": "Please update firmware of following models to 1.10.01 or later version：\nG403, G415, G416, M18, R03, R04, R12, R18\n\nPlease update firmware of following models to 1.10.02 or later version： \nE30, M30, M32, M60, R32\n\nPlease update firmware of following models to 1.20.01 or later version：\nE15, R15"
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "TVN-202406013",
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "D-Link router - Hidden Backdoor",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"affected": [
|
||
{
|
||
"vendor": "dlink",
|
||
"product": "g403_firmware",
|
||
"cpes": [
|
||
"cpe:2.3:o:dlink:r12_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:r18_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:r04_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:r03_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:m18_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:g416_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:g415_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:g403_firmware:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"versions": [
|
||
{
|
||
"version": "0",
|
||
"status": "affected",
|
||
"lessThan": "1.10.01",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"vendor": "dlink",
|
||
"product": "e30_firmware",
|
||
"cpes": [
|
||
"cpe:2.3:o:dlink:r32_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:m60_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:m32_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:m30_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:e30_firmware:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"versions": [
|
||
{
|
||
"version": "0",
|
||
"status": "affected",
|
||
"lessThan": "1.10.02",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"vendor": "dlink",
|
||
"product": "e15_firmware",
|
||
"cpes": [
|
||
"cpe:2.3:o:dlink:r15_firmware:*:*:*:*:*:*:*:*",
|
||
"cpe:2.3:o:dlink:e15_firmware:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"versions": [
|
||
{
|
||
"version": "0",
|
||
"status": "affected",
|
||
"lessThan": "1.20.01",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-06-22T03:55:29.791651Z",
|
||
"id": "CVE-2024-6045",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-06-24T13:16:42.373Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-01T21:25:03.244Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"third-party-advisory",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.twcert.org.tw/tw/cp-132-7879-da630-1.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"third-party-advisory",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://www.twcert.org.tw/en/cp-139-7880-629f5-2.html"
|
||
},
|
||
{
|
||
"tags": [
|
||
"vendor-advisory",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |