[{"vendor":"dlink","product":"dns-320_firmware","defaultStatus":"unknown","cpes":["cpe:2.3:o:dlink:dns-320_firmware:20241028:*:*:*:*:*:*:*"],"versions":[{"version":"20241028","status":"affected"}]},{"vendor":"dlink","product":"dns-320lw_firmware","defaultStatus":"unknown","cpes":["cpe:2.3:o:dlink:dns-320lw_firmware:20241028:*:*:*:*:*:*:*"],"versions":[{"version":"20241028","status":"affected"}]},{"vendor":"dlink","product":"dns-325_firmware","defaultStatus":"unknown","cpes":["cpe:2.3:o:dlink:dns-325_firmware:20241028:*:*:*:*:*:*:*"],"versions":[{"version":"20241028","status":"affected"}]},{"vendor":"dlink","product":"dns-340l_firmware","defaultStatus":"unknown","cpes":["cpe:2.3:o:dlink:dns-340l_firmware:20241028:*:*:*:*:*:*:*"],"versions":[{"version":"20241028","status":"affected"}]}]

{"timestamp":"2024-11-06T16:12:52.250923Z","id":"CVE-2024-10916","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"D-Link","product":"DNS-320","modules":["HTTP GET Request Handler"],"versions":[{"version":"20241028","status":"affected"}]},{"vendor":"D-Link","product":"DNS-320LW","modules":["HTTP GET Request Handler"],"versions":[{"version":"20241028","status":"affected"}]},{"vendor":"D-Link","product":"DNS-325","modules":["HTTP GET Request Handler"],"versions":[{"version":"20241028","status":"affected"}]},{"vendor":"D-Link","product":"DNS-340L","modules":["HTTP GET Request Handler"],"versions":[{"version":"20241028","status":"affected"}]}]

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NIST NVD-CWE-Other

AND
     OR
          *cpe:2.3:o:dlink:dns-320_firmware:*:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:dlink:dns-320:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:dlink:dns-320lw_firmware:*:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:dlink:dns-320lw:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:dlink:dns-325_firmware:*:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:dlink:dns-325:-:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:o:dlink:dns-340l_firmware:*:*:*:*:*:*:*:*
     OR
          cpe:2.3:h:dlink:dns-340l:-:*:*:*:*:*:*:*

https://netsecfish.notion.site/Information-Disclosure-Vulnerability-Report-in-xml-info-xml-for-D-Link-NAS-12d6b683e67c8019a311e699582f51b6?pvs=4 No Types Assigned

https://netsecfish.notion.site/Information-Disclosure-Vulnerability-Report-in-xml-info-xml-for-D-Link-NAS-12d6b683e67c8019a311e699582f51b6?pvs=4 Exploit, Third Party Advisory

https://vuldb.com/?ctiid.283311 No Types Assigned

https://vuldb.com/?ctiid.283311 Third Party Advisory

https://vuldb.com/?id.283311 No Types Assigned

https://vuldb.com/?id.283311 Third Party Advisory

https://vuldb.com/?submit.432849 No Types Assigned

https://vuldb.com/?submit.432849 Third Party Advisory

https://www.dlink.com/ No Types Assigned

https://www.dlink.com/ Product

VulDB CWE-266

A vulnerability classified as problematic has been found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. This affects an unknown part of the file /xml/info.xml of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

VulDB CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

VulDB AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

VulDB (AV:N/AC:L/Au:N/C:P/I:N/A:N)

VulDB CWE-200

VulDB CWE-266

VulDB CWE-284

VulDB https://netsecfish.notion.site/Information-Disclosure-Vulnerability-Report-in-xml-info-xml-for-D-Link-NAS-12d6b683e67c8019a311e699582f51b6?pvs=4 [No types assigned]

VulDB https://vuldb.com/?ctiid.283311 [No types assigned]

VulDB https://vuldb.com/?id.283311 [No types assigned]

VulDB https://vuldb.com/?submit.432849 [No types assigned]

VulDB https://www.dlink.com/ [No types assigned]