← back
CVE-2024-10916

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosure

CVSS 6.9 MEDIUMEPSS 1.5%CWE-200CWE-284
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.9EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
06 Nov 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the file /xml/info.xml of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
D-Link · DNS-320D-Link · DNS-320LWD-Link · DNS-325D-Link · DNS-340L

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://netsecfish.notion.site/Information-Disclosure-Vulnerability-Report-in-xml-info-xml-for-D-Link-NAS-12d6b683e67c8019a311e699582f51b6?pvs=4https://vuldb.com/?ctiid.283311https://vuldb.com/?id.283311https://vuldb.com/?submit.432849https://www.dlink.com/