CVE-2024-5294: d-link dir-3040

Vulnerability summary

CVE-2024-5294 is a medium (CVSS 6.5) vulnerability in d-link dir-3040. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.4% of scored vulnerabilities.

Timeline

1. 23-05-2024
   PublishedVulnerability first disclosed.
2. 01-08-2024
   Last modifiedVulnerability information updated.

Description

D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on ports 80 and 443. The issue results from the lack of proper memory management when processing HTTP cookie values. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. . Was ZDI-CAN-21668.

• CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.