CVE-2024-6044 - Vulnerability Details - OpenCVE

Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0085.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-47202	Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.

Fixes

Solution

Please update firmware of following models to 1.10.01 or later version： G403, G415, G416, M18, R03, R04, R12, R18 Please update firmware of following models to 1.10.02 or later version： E30, M30, M32, M60, R32 Please update firmware of following models to 1.20.01 or later version： E15, R15

Workaround

No workaround given by the vendor.

References

Link	Providers
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398
https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html
https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-06-17T02:30:04.564Z

Updated: 2024-08-01T21:25:03.216Z

Reserved: 2024-06-17T01:58:48.367Z

Link: CVE-2024-6044

Vulnrichment

Updated: 2024-08-01T21:25:03.216Z

NVD

Status : Awaiting Analysis

Published: 2024-06-17T03:15:09.163

Modified: 2024-11-21T09:48:49.963

Link: CVE-2024-6044

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6044", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-06-17T01:58:48.367Z", "datePublished": "2024-06-17T02:30:04.564Z", "dateUpdated": "2024-08-01T21:25:03.216Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "G403", "vendor": "D-Link", "versions": [{"lessThan": "1.10.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "G415", "vendor": "D-Link", "versions": [{"lessThan": "1.10.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "G416", "vendor": "D-Link", "versions": [{"lessThan": "1.10.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "M18", "vendor": "D-Link", "versions": [{"lessThan": "1.10.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "R03", "vendor": "D-Link", "versions": [{"lessThan": "1.10.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "R04", "vendor": "D-Link", "versions": [{"lessThan": "1.10.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "R12", "vendor": "D-Link", "versions": [{"lessThan": "1.10.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "R18", "vendor": "D-Link", "versions": [{"lessThan": "1.10.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "E30", "vendor": "D-Link", "versions": [{"lessThan": "1.10.02", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "M30", "vendor": "D-Link", "versions": [{"lessThan": "1.10.02", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "M32", "vendor": "D-Link", "versions": [{"lessThan": "1.10.02", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "M60", "vendor": "D-Link", "versions": [{"lessThan": "1.10.02", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "R32", "vendor": "D-Link", "versions": [{"lessThan": "1.10.02", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "E15", "vendor": "D-Link", "versions": [{"lessThan": "1.20.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "R15", "vendor": "D-Link", "versions": [{"lessThan": "1.20.01", "status": "affected", "version": "earlier", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL."}], "value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-17T02:30:04.564Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"}, {"tags": ["vendor-advisory"], "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Please update firmware of following models to 1.10.01 or later version\uff1a<br>G403, G415, G416, M18, R03, R04, R12, R18<br><br>Please update firmware of following models to 1.10.02 or later version\uff1a<br>E30, M30, M32, M60, R32<br><br>Please update firmware of following models to 1.20.01 or later version\uff1a<br>E15, R15<br>"}], "value": "Please update firmware of following models to 1.10.01 or later version\uff1a\nG403, G415, G416, M18, R03, R04, R12, R18\n\nPlease update firmware of following models to 1.10.02 or later version\uff1a\nE30, M30, M32, M60, R32\n\nPlease update firmware of following models to 1.20.01 or later version\uff1a\nE15, R15"}], "source": {"advisory": "TVN-202406012", "discovery": "EXTERNAL"}, "title": "D-Link router - Arbitrary File Reading", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-18T14:25:27.426937Z", "id": "CVE-2024-6044", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T14:25:43.368Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:03.216Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:03.216Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6044", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-18T14:25:27.426937Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T14:25:40.312Z"}}], "cna": {"title": "D-Link router - Arbitrary File Reading", "source": {"advisory": "TVN-202406012", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "D-Link", "product": "G403", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "G415", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "G416", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "M18", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "R03", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "R04", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "R12", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "R18", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "E30", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.02", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "M30", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.02", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "M32", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.02", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "M60", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.02", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "R32", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.10.02", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "E15", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.20.01", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "D-Link", "product": "R15", "versions": [{"status": "affected", "version": "earlier", "lessThan": "1.20.01", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Please update firmware of following models to 1.10.01 or later version\uff1a\nG403, G415, G416, M18, R03, R04, R12, R18\n\nPlease update firmware of following models to 1.10.02 or later version\uff1a\nE30, M30, M32, M60, R32\n\nPlease update firmware of following models to 1.20.01 or later version\uff1a\nE15, R15", "supportingMedia": [{"type": "text/html", "value": "Please update firmware of following models to 1.10.01 or later version\uff1a<br>G403, G415, G416, M18, R03, R04, R12, R18<br><br>Please update firmware of following models to 1.10.02 or later version\uff1a<br>E30, M30, M32, M60, R32<br><br>Please update firmware of following models to 1.20.01 or later version\uff1a<br>E15, R15<br>", "base64": false}]}], "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html", "tags": ["third-party-advisory"]}, {"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.", "supportingMedia": [{"type": "text/html", "value": "Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-06-17T02:30:04.564Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6044", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:25:03.216Z", "dateReserved": "2024-06-17T01:58:48.367Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-06-17T02:30:04.564Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}