CVE-2024-13030
D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access control
- State
- Published
- Severity
- 6.9 Medium
- Published
- Dec 30, 2024
- Updated
- Dec 30, 2024
- Reserved
- Dec 29, 2024
Description
A vulnerability was found in D-Link DIR-823G 1.0.2B05_20181207. It has been rated as critical. This issue affects the function SetAutoRebootSettings/SetClientInfo/SetDMZSettings/SetFirewallSettings/SetParentsControlInfo/SetQoSSettings/SetVirtualServerSettings of the file /HNAP1/ of the component Web Management Interface. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
DIR-823GD-Link |
|
References
- VDB-289763 | D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access controlvdb-entrytechnical-description
- VDB-289763 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #467903 | D-Link DIR823G V1.0.2B05_20181207 Improper Access Controlsthird-party-advisory
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-823G/SetAutoRebootSettings.mdexploit
- https://www.dlink.com.cn/about/article/news?id=2247broken-link
- https://www.dlink.com/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.