{"id":"CVE-2024-6044","state":"PUBLISHED","title":"D-Link router - Arbitrary File Reading","description":"Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.","publishedAt":"2024-06-17T02:30:04.564Z","updatedAt":"2024-08-01T21:25:03.216Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"twcert"},"assigner":"twcert","products":["D-Link G403","D-Link G415","D-Link G416","D-Link M18","D-Link R03","D-Link R04","D-Link R12","D-Link R18","D-Link E30","D-Link M30","D-Link M32","D-Link M60","D-Link R32","D-Link E15","D-Link R15"],"affected":[{"vendor":"D-Link","product":"G403","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"G415","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"G416","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"M18","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R03","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R04","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R12","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R18","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"E30","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"M30","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"M32","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"M60","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"R32","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"E15","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.20.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R15","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.20.01","versionType":"custom"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html","https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html","https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6044.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-6044","state":"PUBLISHED","datePublished":"2024-06-17T02:30:04.564Z","dateUpdated":"2024-08-01T21:25:03.216Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2024-06-17T01:58:48.367Z"},"containers":{"cna":{"title":"D-Link router - Arbitrary File Reading","descriptions":[{"lang":"en","value":"Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL."}],"affected":[{"vendor":"D-Link","product":"G403","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"G415","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"G416","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"M18","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R03","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R04","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R12","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R18","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.01","versionType":"custom"}]},{"vendor":"D-Link","product":"E30","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"M30","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"M32","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"M60","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"R32","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.10.02","versionType":"custom"}]},{"vendor":"D-Link","product":"E15","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.20.01","versionType":"custom"}]},{"vendor":"D-Link","product":"R15","defaultStatus":"unaffected","versions":[{"version":"earlier","status":"affected","lessThan":"1.20.01","versionType":"custom"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html","tags":["third-party-advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html","tags":["third-party-advisory"]},{"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateUpdated":"2024-06-17T02:30:04.564Z"},"impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Please update firmware of following models to 1.10.01 or later version：<br>G403, G415, G416, M18, R03, R04, R12, R18<br><br>Please update firmware of following models to 1.10.02 or later version：<br>E30, M30, M32, M60, R32<br><br>Please update firmware of following models to 1.20.01 or later version：<br>E15, R15<br>"}],"value":"Please update firmware of following models to 1.10.01 or later version：\nG403, G415, G416, M18, R03, R04, R12, R18\n\nPlease update firmware of following models to 1.10.02 or later version：\nE30, M30, M32, M60, R32\n\nPlease update firmware of following models to 1.20.01 or later version：\nE15, R15"}],"source":{"advisory":"TVN-202406012","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-18T14:25:27.426937Z","id":"CVE-2024-6044","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-18T14:25:43.368Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.twcert.org.tw/tw/cp-132-7877-b4674-1.html","tags":["third-party-advisory","x_transferred"]},{"url":"https://www.twcert.org.tw/en/cp-139-7878-7c3d9-2.html","tags":["third-party-advisory","x_transferred"]},{"url":"https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:25:03.216Z"}}]}}}