ID
VAR-202405-0224
CVE
CVE-2024-5294
TITLE
(0Day) D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability
Trust: 0.7
DESCRIPTION
D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on ports 80 and 443. The issue results from the lack of proper memory management when processing HTTP cookie values. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-21668. D-Link DIR-3040 is a router of D-Link, a Chinese company. It provides the function of connecting to the network. The vulnerability is caused by not releasing or failing to release dynamically allocated heap memory
Trust: 2.07
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | d link | model: | dir-3040 | scope: | - | version: | - | Trust: 1.3 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-401 | Trust: 1.0 |
PATCH
| title: | 08/16/23 – ZDI reported the vulnerabilities to the vendor08/24/23 – The vendor communicated that the cases would be fixed in Q4, 2023 release05/01/24 – ZDI notified the vendor of the intention to publish the case as 0-day advisory on 05/14/24-- Mitigation: On May 14, 2024, the vendor informed ZDI about the beta software update v120B03a Beta Hot-Fix | url: | https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10387 | Trust: 0.7 |
| title: | Patch for D-Link DIR-3040 Memory Leak Vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/554371 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-5294 | Trust: 2.3 |
| db: | ZDI | id: | ZDI-24-445 | Trust: 2.3 |
| db: | ZDI_CAN | id: | ZDI-CAN-21668 | Trust: 0.7 |
| db: | CNVD | id: | CNVD-2024-26086 | Trust: 0.6 |
REFERENCES
| url: | https://www.zerodayinitiative.com/advisories/zdi-24-445/ | Trust: 1.6 |
| url: | https://supportannouncement.us.dlink.com/security/publication.aspx?name=sap10387 | Trust: 0.7 |
CREDITS
Nicholas Zubrisky
Trust: 0.7
SOURCES
| db: | ZDI | id: | ZDI-24-445 |
| db: | CNVD | id: | CNVD-2024-26086 |
| db: | NVD | id: | CVE-2024-5294 |
LAST UPDATE DATE
2024-08-14T15:15:28.892000+00:00
SOURCES UPDATE DATE
| db: | ZDI | id: | ZDI-24-445 | date: | 2024-07-01T00:00:00 |
| db: | CNVD | id: | CNVD-2024-26086 | date: | 2024-06-06T00:00:00 |
| db: | NVD | id: | CVE-2024-5294 | date: | 2024-05-24T01:15:30.977 |
SOURCES RELEASE DATE
| db: | ZDI | id: | ZDI-24-445 | date: | 2024-05-24T00:00:00 |
| db: | CNVD | id: | CNVD-2024-26086 | date: | 2024-06-06T00:00:00 |
| db: | NVD | id: | CVE-2024-5294 | date: | 2024-05-23T22:15:15.213 |