What is the CVSS score of CVE-2024-0717?

CVE-2024-0717 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 18.2%.

Is there a public PoC exploit available for CVE-2024-0717?

Yes, a public proof-of-concept exploit is available for CVE-2024-0717. Prioritise patching immediately. EPSS: 18.2%.

Dir 615 Firmware CVE-2024-0717

MEDIUM

Information Exposure (CWE-200)

2024-01-19 cna@vuldb.com

Information Disclosure D-Link Dir 615 Firmware Dir 815 Firmware Dir 816 Firmware Dir 825 Firmware Dir 878 Firmware Dir 853 Firmware Dir 300 Firmware Dir 1260 Firmware Dir 882 Firmware Dir 822 Firmware Dir 806A Firmware Dap 1360 Firmware Dir X1860 Firmware Dsl 2640U Firmware Dir 620 Firmware Dwr 921 Firmware Dsl 2750U Firmware Dir 842 Firmware Dir 841 Firmware Dsl 224 Firmware Dir 2150 Firmware Dir 825Acg1 Firmware Dir X1530 Firmware Dir 1210 Firmware Dsl 245Gr Firmware Dsl G2452Gr Firmware Dir 825Acf Firmware Dir 615T Firmware Dir 842S Firmware Dir 815S Firmware Dir 615S Firmware Dvg 5402G Firmware Dwm 312W Firmware Dir 815 Ac Firmware Dwm 321 Firmware Dir 820 Firmware Dir 843 Firmware Dvg 5402G Gfru Firmware Dwr 953 Firmware Dvg N5402G Il Firmware Dir 825Ac Firmware Dir 620S Firmware Dvg N5402G Firmware Dir 615Gf Firmware

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jan 19, 2024 - 16:15 nvd

MEDIUM 5.3

DescriptionNVD

A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1, DIR-841, DIR-842, DIR-842S, DIR-843, DIR-853, DIR-878, DIR-882, DIR-1210, DIR-1260, DIR-2150, DIR-X1530, DIR-X1860, DSL-224, DSL-245GR, DSL-2640U, DSL-2750U, DSL-G2452GR, DVG-5402G, DVG-5402G, DVG-5402GFRU, DVG-N5402G, DVG-N5402G-IL, DWM-312W, DWM-321, DWR-921, DWR-953 and Good Line Router v2 up to 20240112. This vulnerability affects unknown code of the file /devinfo of the component HTTP GET Request Handler. The manipulation of the argument area with the input notice|net|version leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251542 is the identifier assigned to this vulnerability.

AnalysisAI

A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1, DIR-841, DIR-842, DIR-842S, DIR-843, DIR-853, DIR-878, DIR-882, DIR-1210, DIR-1260, DIR-2150, DIR-X1530, DIR-X1860, DSL-224, DSL-245GR, DSL-2640U, DSL-2750U, DSL-G2452GR, DVG-5402G, DVG-5402G, DVG-5402GFRU, DVG-N5402G, DVG-N5402G-IL, DWM-312W, DWM-321, DWR-921, DWR-953 and Good Line Router v2 up to 20240112. This vulnerability affects unknown code of the file /devinfo of the component HTTP GET Request Handler. The manipulation of the argument area with the input notice|net|version leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251542 is the identifier assigned to this vulnerability. Affected products include: Dlink Dir-825Acg1 Firmware, Dlink Dir-841 Firmware, Dlink Dir-1260 Firmware, Dlink Dir-822 Firmware, Dlink Dir-X1530 Firmware. Version information: up to 20240112..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.