CVE-2024-7922

Published: Aug 19, 2024Modified: Aug 20, 2024

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function cgi_audio_search/cgi_create_playlist/cgi_get_album_all_tracks/cgi_get_alltracks_editlist/cgi_get_artist_all_album/cgi_get_genre_all_tracks/cgi_get_tracks_list/cgi_set_airplay_content/cgi_write_playlist of the file /cgi-bin/myMusic.cgi. The manipulation leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

Affected (20)

Products: Dell: Dns 120 Firmware, Dnr 202l Firmware, Dns 315l Firmware, Dns 320 Firmware, Dns 320l Firmware, Dns 320lw Firmware, Dns 321 Firmware, Dnr 322l Firmware, Dns 323 Firmware, Dns 325 Firmware, Dns 326 Firmware, Dns 327l Firmware, Dnr 326 Firmware, Dns 340l Firmware, Dns 343 Firmware, Dns 345 Firmware, Dns 726 4 Firmware, Dns 1100 4 Firmware, Dns 1200 05 Firmware, Dns 1550 04 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 120 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 120	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dnr 202l Firmware	All versions

Running on/with	Platform Versions
Dell Dnr 202l	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 315l Firmware	All versions

Running on/with	Platform Versions
Dell Dns 315l	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 320 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 320	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 320l Firmware	All versions

Running on/with	Platform Versions
Dell Dns 320l	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 320lw Firmware	All versions

Running on/with	Platform Versions
Dell Dns 320lw	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 321 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 321	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dnr 322l Firmware	All versions

Running on/with	Platform Versions
Dell Dnr 322l	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 323 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 323	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 325 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 325	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 326 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 326	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 327l Firmware	All versions

Running on/with	Platform Versions
Dell Dns 327l	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dnr 326 Firmware	All versions

Running on/with	Platform Versions
Dell Dnr 326	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 340l Firmware	All versions

Running on/with	Platform Versions
Dell Dns 340l	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 343 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 343	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 345 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 345	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 726 4 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 726 4	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 1100 4 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 1100 4	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 1200 05 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 1200 05	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dell Dns 1550 04 Firmware	All versions

Running on/with	Platform Versions
Dell Dns 1550 04	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (6)

https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_create_playlist.md

Source: cna@vuldb.com

Exploit

https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_get_tracks_list.md

Source: cna@vuldb.com

Exploit

https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383

Source: cna@vuldb.com

Vendor Advisory

https://vuldb.com/?ctiid.275108

Source: cna@vuldb.com

Permissions RequiredVDB Entry

https://vuldb.com/?id.275108

Source: cna@vuldb.com

Permissions RequiredVDB Entry

https://vuldb.com/?submit.391669

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

Timeline

No history available yet.