A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classified as critical. This affects the function webdav_mgr of the file /cgi-bin/webdav_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
History

Tue, 27 Aug 2024 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Dlink dnr-202l
Dlink dnr-322l
Dlink dnr-326
Dlink dns-1100-4
Dlink dns-120
Dlink dns-1200-05
Dlink dns-1550-04
Dlink dns-315l
Dlink dns-320
Dlink dns-320l
Dlink dns-320lw
Dlink dns-321
Dlink dns-323
Dlink dns-325
Dlink dns-326
Dlink dns-327l
Dlink dns-340l
Dlink dns-343
Dlink dns-345
Dlink dns-726-4
Weaknesses CWE-78
CPEs cpe:2.3:h:dlink:dnr-202l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dnr-322l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dnr-326:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-1100-4:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-1200-05:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-120:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-1550-04:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-315l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-320l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-321:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-323:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-326:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-327l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-343:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-345:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-726-4:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dnr-202l_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dnr-322l_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dnr-326_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1100-4_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1200-05_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-120_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1550-04_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-315l_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320l_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320lw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-321_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-323_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-325_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-326_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-327l_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-340l_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-343_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-345_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-726-4_firmware:-:*:*:*:*:*:*:*
Vendors & Products Dlink dnr-202l
Dlink dnr-322l
Dlink dnr-326
Dlink dns-1100-4
Dlink dns-120
Dlink dns-1200-05
Dlink dns-1550-04
Dlink dns-315l
Dlink dns-320
Dlink dns-320l
Dlink dns-320lw
Dlink dns-321
Dlink dns-323
Dlink dns-325
Dlink dns-326
Dlink dns-327l
Dlink dns-340l
Dlink dns-343
Dlink dns-345
Dlink dns-726-4

Mon, 26 Aug 2024 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dnr-202l Firmware
Dlink dnr-322l Firmware
Dlink dnr-326 Firmware
Dlink dns-1100-4 Firmware
Dlink dns-1200-05 Firmware
Dlink dns-120 Firmware
Dlink dns-1550-04 Firmware
Dlink dns-315l Firmware
Dlink dns-320 Firmware
Dlink dns-320l Firmware
Dlink dns-320lw Firmware
Dlink dns-321 Firmware
Dlink dns-323 Firmware
Dlink dns-325 Firmware
Dlink dns-326 Firmware
Dlink dns-327l Firmware
Dlink dns-340l Firmware
Dlink dns-343 Firmware
Dlink dns-345 Firmware
Dlink dns-726-4 Firmware
CPEs cpe:2.3:o:dlink:dnr-202l_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dnr-322l_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dnr-326_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1100-4_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1200-05_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-120_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-1550-04_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-315l_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320l_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320lw_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-321_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-323_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-325_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-326_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-327l_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-340l_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-343_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-345_firmware:20240814:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-726-4_firmware:20240814:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dnr-202l Firmware
Dlink dnr-322l Firmware
Dlink dnr-326 Firmware
Dlink dns-1100-4 Firmware
Dlink dns-1200-05 Firmware
Dlink dns-120 Firmware
Dlink dns-1550-04 Firmware
Dlink dns-315l Firmware
Dlink dns-320 Firmware
Dlink dns-320l Firmware
Dlink dns-320lw Firmware
Dlink dns-321 Firmware
Dlink dns-323 Firmware
Dlink dns-325 Firmware
Dlink dns-326 Firmware
Dlink dns-327l Firmware
Dlink dns-340l Firmware
Dlink dns-343 Firmware
Dlink dns-345 Firmware
Dlink dns-726-4 Firmware
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Sat, 24 Aug 2024 18:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classified as critical. This affects the function webdav_mgr of the file /cgi-bin/webdav_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
Title D-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injection
Weaknesses CWE-77
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2024-08-24T18:00:05.836Z

Updated: 2024-08-26T15:54:41.469Z

Reserved: 2024-08-23T18:30:00.444Z

Link: CVE-2024-8132

cve-icon Vulnrichment

Updated: 2024-08-26T15:54:27.873Z

cve-icon NVD

Status : Analyzed

Published: 2024-08-24T18:15:04.727

Modified: 2024-08-27T15:35:01.557

Link: CVE-2024-8132

cve-icon Redhat

No data.