Details of VAR-202408-2287

ID

VAR-202408-2287

CVE

CVE-2024-8127

TITLE

plural D-Link Systems, Inc. In the product OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2024-006754

DESCRIPTION

A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_unzip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced. dns-1550-04 firmware, dns-1200-05 firmware, dns-1100-4 firmware etc. D-Link Systems, Inc. The product has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2024-8127 // JVNDB: JVNDB-2024-006754

AFFECTED PRODUCTS

vendor:	dlink	model:	dns-345	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-726-4	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-320	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-327l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-320l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-315l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-325	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-321	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dnr-322l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-340l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-326	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-1100-4	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dnr-202l	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-120	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dnr-326	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-1550-04	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-343	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-323	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-1200-05	scope:	eq	version:	-	Trust: 1.0
vendor:	dlink	model:	dns-320lw	scope:	eq	version:	-	Trust: 1.0
vendor:	d link	model:	d-link dns-325	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dnr-326	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-320l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-320	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-1100-4	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-321	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-315l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-323	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-1200-05	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-120	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-327l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-320lw	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	d-link dns-345	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dnr-322l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-1550-04	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-726-4	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-343	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-340l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dnr-202l	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	dns-326	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2024-006754 // NVD: CVE-2024-8127

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2024-8127
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2024-8127
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2024-006754
value:	CRITICAL
Trust: 0.8

cna@vuldb.com:	CVE-2024-8127
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2024-006754
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

cna@vuldb.com:	CVE-2024-8127
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2024-8127
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2024-006754
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2024-006754 // NVD: CVE-2024-8127 // NVD: CVE-2024-8127

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.0
problemtype:	CWE-77	Trust: 1.0
problemtype:	OS Command injection (CWE-78) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-006754 // NVD: CVE-2024-8127

EXTERNAL IDS

db:	NVD	id:	CVE-2024-8127	Trust: 2.6
db:	DLINK	id:	SAP10383	Trust: 1.8
db:	VULDB	id:	275698	Trust: 1.0
db:	JVNDB	id:	JVNDB-2024-006754	Trust: 0.8

sources: JVNDB: JVNDB-2024-006754 // NVD: CVE-2024-8127

REFERENCES

url:	https://github.com/buaaiotteam/iot_dlink_nas/blob/main/dns_cgi_unzip.md	Trust: 1.8
url:	https://supportannouncement.us.dlink.com/security/publication.aspx?name=sap10383	Trust: 1.8
url:	https://vuldb.com/?submit.396236	Trust: 1.8
url:	https://www.dlink.com/	Trust: 1.8
url:	https://vuldb.com/?ctiid.275698	Trust: 1.0
url:	https://vuldb.com/?id.275698	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2024-8127	Trust: 0.8

sources: JVNDB: JVNDB-2024-006754 // NVD: CVE-2024-8127

SOURCES

db:	JVNDB	id:	JVNDB-2024-006754
db:	NVD	id:	CVE-2024-8127

LAST UPDATE DATE

2024-08-30T19:20:32.953000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2024-006754	date:	2024-08-28T08:08:00
db:	NVD	id:	CVE-2024-8127	date:	2024-08-27T14:53:45.257

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2024-006754	date:	2024-08-28T00:00:00
db:	NVD	id:	CVE-2024-8127	date:	2024-08-24T10:15:04.370