CVE-2023-32152mediumCWE-303

CVE-2023-32152: falha de média gravidade em D-Link DIR-2640

D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar DIR-2640

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

18Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 29%
D-Link DIR-2640 HNAP LoginPassword Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-2640 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management interface, which listens on TCP port 80 by default. A specially crafted login request can cause authentication to succeed without providing proper credentials. An attacker can leverage this vulnerability to bypass authentication on the system. . Was ZDI-CAN-19549.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
D-Link · DIR-2640
CVEs relacionadas — D-Link DIR-2640

No mesmo produto, das mais perigosas para as menos.

CVE-2023-32148MEDIUMD-Link DIR-2640 HNAP PrivateLogin Authentication Bypass VulnerabilityEPSS 28.9%CVE-2023-32153MEDIUMD-Link DIR-2640 EmailFrom Command Injection Remote Code Execution VulnerabilityEPSS 26.9%CVE-2023-32150MEDIUMD-Link DIR-2640 PrefixLen Command Injection Remote Code Execution VulnerabilityEPSS 26.9%CVE-2023-32151MEDIUMD-Link DIR-2640 DestNetwork Command Injection Remote Code Execution VulnerabilityEPSS 1.8%CVE-2023-32147MEDIUMD-Link DIR-2640 LocalIPAddress Command Injection Remote Code Execution VulnerabilityEPSS 1.8%CVE-2024-5293HIGHD-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution VulnerabilityEPSS 1.6%