Vulnerability in D-Link Dir-3040
CVE-2024-5294
D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on ports 80 and 443. The issue results from the lack of proper memory management when processing HTTP cookie values. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. . Was ZDI-CAN-21668.
EPSS: 0.005 (37.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- D-link Dir-3040 — versions 120B03
- Dlink Dir-3040
- Dlink Dir-3040_firmware — versions 120b03
Weakness classification (CWE)
Public proof-of-concept exploits
References
- zdi-disclosures@trendmicro.com (x_research-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-5294?
- CVE-2024-5294 is a medium-severity vulnerability in D-Link Dir-3040, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 6.5/10. Published 2024-05-23.
- How severe is CVE-2024-5294?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2024-5294 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.