CVE-2024-10916

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosure

Published Nov 6, 2024 CVSS 4.0 · 6.9 Medium EPSS 1.5% KEV · Not listed
Description
A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the file /xml/info.xml of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-33346 A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the file /xml/info.xml of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00281}

epss

{'score': 0.00305}

Type Values Removed Values Added
First Time appeared Dlink dns-320
Dlink dns-320lw
Dlink dns-325
Dlink dns-340l
Weaknesses NVD-CWE-Other
CPEs cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*
cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*
Vendors & Products Dlink dns-320
Dlink dns-320lw
Dlink dns-325
Dlink dns-340l
Type Values Removed Values Added
First Time appeared Dlink
Dlink dns-320 Firmware
Dlink dns-320lw Firmware
Dlink dns-325 Firmware
Dlink dns-340l Firmware
CPEs cpe:2.3:o:dlink:dns-320_firmware:20241028:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-320lw_firmware:20241028:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-325_firmware:20241028:*:*:*:*:*:*:*
cpe:2.3:o:dlink:dns-340l_firmware:20241028:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dns-320 Firmware
Dlink dns-320lw Firmware
Dlink dns-325 Firmware
Dlink dns-340l Firmware
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Weaknesses CWE-266
Type Values Removed Values Added
Description A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the file /xml/info.xml of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Title D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosure
Weaknesses CWE-200
CWE-266
CWE-284
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}