CVE-2024-5299 - D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability

Back Back to CVE browser

HIGH

D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability

Published May 23, 2024

8.8

HIGH

CVSS 3.0

EPSS 1.82%

Description

D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the execMonitorScript method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21828.

Affected products

Vendor D-Link Product D-View Default
n/a
- Version
  2.0.1.28
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

D-Link

D-View

n/a

Version	Status	Constraints
2.0.1.28	affected	-

Vendor D-Link Product D-View Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <2.0.3.88

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

D-Link

D-View

n/a

Version	Status	Constraints
0	affected	<2.0.3.88

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-749

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46535
Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-450/
x_research-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46535		Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-450/		x_research-advisoryThird Party Advisory