Details of VAR-202408-2286

ID

VAR-202408-2286

CVE

CVE-2024-8128

TITLE

plural D-Link Systems, Inc. In the product OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2024-006701

DESCRIPTION

A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This issue affects the function cgi_add_zip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. dns-1550-04 firmware, dns-1200-05 firmware, dns-1100-4 firmware etc. D-Link Systems, Inc. The product has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2024-8128 // JVNDB: JVNDB-2024-006701

AFFECTED PRODUCTS

vendor:	dlink	model:	dns-340l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-321	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-320	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-1100-4	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dnr-326	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-326	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-343	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-323	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-315l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-120	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-1200-05	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-327l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-320l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-320lw	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-325	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-1550-04	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dnr-322l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dnr-202l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-345	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-726-4	scope:	eq	version:	-	Trust: 1.0
vendor:	d link	model:	dns-1550-04	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-320l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-345	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dnr-322l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dnr-326	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-315l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-320lw	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-321	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-325	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-1200-05	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-726-4	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-343	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-326	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dnr-202l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-323	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-320	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-120	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-340l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-327l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-1100-4	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2024-006701 // NVD: CVE-2024-8128

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2024-8128
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2024-8128
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2024-006701
value:	CRITICAL
Trust: 0.8

cna@vuldb.com:	CVE-2024-8128
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2024-006701
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

cna@vuldb.com:	CVE-2024-8128
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2024-8128
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2024-006701
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2024-006701 // NVD: CVE-2024-8128 // NVD: CVE-2024-8128

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.0
problemtype:	CWE-77	Trust: 1.0
problemtype:	OS Command injection (CWE-78) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-006701 // NVD: CVE-2024-8128

EXTERNAL IDS

db:	NVD	id:	CVE-2024-8128	Trust: 2.6
db:	DLINK	id:	SAP10383	Trust: 1.8
db:	VULDB	id:	275699	Trust: 1.8
db:	JVNDB	id:	JVNDB-2024-006701	Trust: 0.8

sources: JVNDB: JVNDB-2024-006701 // NVD: CVE-2024-8128

REFERENCES

url:	https://github.com/buaaiotteam/iot_dlink_nas/blob/main/dns_cgi_add_zip.md	Trust: 1.8
url:	https://supportannouncement.us.dlink.com/security/publication.aspx?name=sap10383	Trust: 1.8
url:	https://vuldb.com/?id.275699	Trust: 1.8
url:	https://vuldb.com/?submit.396237	Trust: 1.8
url:	https://www.dlink.com/	Trust: 1.8
url:	https://vuldb.com/?ctiid.275699	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2024-8128	Trust: 0.8

sources: JVNDB: JVNDB-2024-006701 // NVD: CVE-2024-8128

SOURCES

db:	JVNDB	id:	JVNDB-2024-006701
db:	NVD	id:	CVE-2024-8128

LAST UPDATE DATE

2024-08-29T19:20:51.305000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2024-006701	date:	2024-08-28T00:55:00
db:	NVD	id:	CVE-2024-8128	date:	2024-08-27T15:32:47.997

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2024-006701	date:	2024-08-28T00:00:00
db:	NVD	id:	CVE-2024-8128	date:	2024-08-24T12:15:04.557