Exploit
CVE-2024-9550

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)

Published: Oct 6, 2024 / Updated: 44d ago

010
CVSS 8.7EPSS 0.05%High
CVE info copied to clipboard

Summary

A critical vulnerability has been discovered in the D-Link DIR-605L router, specifically in version 2.13B01 BETA. The vulnerability affects the formLogDnsquery function in the /goform/formLogDnsquery file. By manipulating the curTime argument, an attacker can cause a buffer overflow. This vulnerability can be exploited remotely, and the exploit has been publicly disclosed.

Impact

The impact of this vulnerability is severe. If exploited, it could lead to: 1. Remote Code Execution: The buffer overflow could allow attackers to execute arbitrary code on the affected device. 2. Unauthorized Access: Attackers might gain unauthorized access to the router's administrative functions. 3. Network Compromise: As this affects a network device, a successful exploit could compromise the entire network connected to the router. 4. Data Theft: Given the high confidentiality impact, sensitive information passing through the router could be intercepted or stolen. 5. Device Control: Attackers could potentially take full control of the router, using it for further attacks or to monitor network traffic. The CVSS v3.1 base score of 8.8 (High) indicates a significant risk, with high impacts on confidentiality, integrity, and availability.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

As of the provided information, there is no mention of an available patch. The vulnerability is present in D-Link DIR-605L version 2.13B01 BETA. Users should check the D-Link support website for any security updates or new firmware versions that address this vulnerability.

Mitigation

Given the critical nature of this vulnerability and the lack of a confirmed patch, the following mitigation steps are recommended: 1. Disable Remote Management: If possible, disable remote management features on the router to reduce the attack surface. 2. Firewall Rules: Implement strict firewall rules to limit access to the router's management interface from trusted IP addresses only. 3. Network Segmentation: Isolate the affected router in a separate network segment to minimize potential impact. 4. Monitor for Updates: Regularly check for firmware updates from D-Link and apply them as soon as they become available. 5. Replace Hardware: Consider replacing the vulnerable router with a newer, more secure model if no patch is forthcoming. 6. Intrusion Detection: Implement network intrusion detection systems to monitor for potential exploitation attempts. 7. Strong Authentication: Ensure that strong, unique passwords are used for router access. 8. Regular Security Audits: Conduct regular security audits of your network infrastructure to identify and address vulnerabilities. Given the high severity and public disclosure of the exploit, prioritize addressing this vulnerability in your patching and remediation efforts.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9550. See article

Oct 6, 2024 at 9:13 AM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 6, 2024 at 9:14 AM
CVE Assignment

NVD published the first details for CVE-2024-9550

Oct 6, 2024 at 9:15 AM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 6, 2024 at 9:20 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.4%)

Oct 7, 2024 at 2:15 PM
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Oct 9, 2024 at 1:11 PM
Static CVE Timeline Graph

Affected Systems

Dlink/dir-605l_firmware
+null more

Exploits

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formLogDnsquery.md
+null more

Attack Patterns

CAPEC-10: Buffer Overflow via Environment Variables
+null more

News

Vulnerability Summary for the Week of September 30, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info n/a–n/a An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the application is remotely accessible, it allows an attacker to execute arbitrary commands with system privilege on the endpoint hosting the application, without any authentication. 2024-09-30 10 CVE-2024-42017 cve@mitre.org cve@mitre.org Cisco–Cisco Data Center Network Manager A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to improper user authorization and insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted commands to an affected REST API endpoint or through the web UI. A successful exploit could allow the attacker to execute arbitrary commands on the CLI of a Cisco NDFC-managed device with network-admin privileges. Note: This vulnerability does not affect Cisco NDFC when it is configured for storage area network (SAN) controller deployment. 2024-10-02 9.9 CVE-2024-20432 ykramarz@cisco.com n/a–n/a The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges.
CVE-2024-9550 Exploit
CVE Id : CVE-2024-9550 Published Date: 2024-10-09T11:15:00+00:00 A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formLogDnsquery of the file /goform/formLogDnsquery. The manipulation of the argument curTime leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. inTheWild added a link to an exploit: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-605L/formLogDnsquery.md
Security Bulletin 09 Oct 2024 - Cyber Security Agency of Singapore
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Chart Builder Team Chartify allows ...
US-CERT Vulnerability Summary for the Week of September 30, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
Vulnerability Summary for the Week of September 30, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
See 6 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI