Details of VAR-202411-0447

ID

VAR-202411-0447

CVE

CVE-2024-11046

TITLE

D-Link Systems, Inc. of di-8003 Command injection vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-012564

DESCRIPTION

A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been classified as critical. Affected is the function upgrade_filter_asp of the file /upgrade_filter.asp. The manipulation of the argument path leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. D-Link Systems, Inc. of di-8003 The firmware contains a command injection vulnerability. OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. D-Link DI-8003 is a wireless router from D-Link of China. D-Link DI-8003 version 16.07.16A1 has a command injection vulnerability, which is caused by the parameter path of the file /upgrade_filter.asp failing to properly filter special characters and commands in the constructed command. Attackers can exploit this vulnerability to cause arbitrary command execution

Trust: 2.16

sources: NVD: CVE-2024-11046 // JVNDB: JVNDB-2024-012564 // CNVD: CNVD-2024-44852

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-44852

AFFECTED PRODUCTS

vendor:	dlink	model:	di-8003	scope:	eq	version:	16.07.16a1	Trust: 1.0
vendor:	d link	model:	di-8003	scope:	eq	version:	-	Trust: 0.8
vendor:	d link	model:	di-8003	scope:	eq	version:	di-8003 firmware 16.07.16a1	Trust: 0.8
vendor:	d link	model:	di-8003	scope:	-	version:	-	Trust: 0.8
vendor:	d link	model:	di-8003 16.07.16a1	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2024-44852 // JVNDB: JVNDB-2024-012564 // NVD: CVE-2024-11046

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2024-11046
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2024-11046
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2024-012564
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2024-44852
value:	MEDIUM
Trust: 0.6

cna@vuldb.com:	CVE-2024-11046
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2024-012564
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2024-44852
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2024-11046
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2024-11046
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2024-012564
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2024-44852 // JVNDB: JVNDB-2024-012564 // NVD: CVE-2024-11046 // NVD: CVE-2024-11046

PROBLEMTYPE DATA

problemtype:	CWE-77	Trust: 1.0
problemtype:	CWE-78	Trust: 1.0
problemtype:	Command injection (CWE-77) [ others ]	Trust: 0.8
problemtype:	OS Command injection (CWE-78) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-012564 // NVD: CVE-2024-11046

PATCH

title:

Patch for D-Link DI-8003 Command Injection Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/618151

Trust: 0.6

sources: CNVD: CNVD-2024-44852

EXTERNAL IDS

db:	NVD	id:	CVE-2024-11046	Trust: 3.2
db:	VULDB	id:	283632	Trust: 2.4
db:	JVNDB	id:	JVNDB-2024-012564	Trust: 0.8
db:	CNVD	id:	CNVD-2024-44852	Trust: 0.6

sources: CNVD: CNVD-2024-44852 // JVNDB: JVNDB-2024-012564 // NVD: CVE-2024-11046

REFERENCES

url:	https://vuldb.com/?id.283632	Trust: 2.4
url:	https://github.com/theraz0r/iot-mycve/blob/main/dlink_di8003_command_injection/di8003_command_injection.md	Trust: 1.8
url:	https://vuldb.com/?submit.434929	Trust: 1.8
url:	https://www.dlink.com/	Trust: 1.8
url:	https://vuldb.com/?ctiid.283632	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2024-11046	Trust: 0.8

sources: CNVD: CNVD-2024-44852 // JVNDB: JVNDB-2024-012564 // NVD: CVE-2024-11046

SOURCES

db:	CNVD	id:	CNVD-2024-44852
db:	JVNDB	id:	JVNDB-2024-012564
db:	NVD	id:	CVE-2024-11046

LAST UPDATE DATE

2024-11-15T23:00:26.584000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-44852	date:	2024-11-14T00:00:00
db:	JVNDB	id:	JVNDB-2024-012564	date:	2024-11-14T02:47:00
db:	NVD	id:	CVE-2024-11046	date:	2024-11-13T21:01:01.540

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-44852	date:	2024-11-14T00:00:00
db:	JVNDB	id:	JVNDB-2024-012564	date:	2024-11-14T00:00:00
db:	NVD	id:	CVE-2024-11046	date:	2024-11-10T03:15:03.940