CVE-2024-10916

Katalog CVE

CVSS 5.3 · Medium EPSS 1,5%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada dlink dns-320 firmware, dlink dns-320lw firmware +2 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the file /xml/info.xml of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

6 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://netsecfish.notion.site/Information-Disclosure-Vulnerability-Report-in-xml-info-xml-for-D-Link-NAS-12d6... exploit · advisory pihak ketiga
• https://vuldb.com/?ctiid.283311 advisory pihak ketiga
• https://vuldb.com/?id.283311 advisory pihak ketiga
• https://vuldb.com/?submit.432849 advisory pihak ketiga
• https://www.dlink.com/ product