CVE-2024-7828
HIGHDescription
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_set_cover of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument album_name leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.
Is your site exposed to CVE-2024-7828?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| dlink | dns-120_firmware |
| dlink | dns-120 |
| dlink | dnr-202l_firmware |
| dlink | dnr-202l |
| dlink | dns-315l_firmware |
| dlink | dns-315l |
| dlink | dns-320_firmware |
| dlink | dns-320 |
| dlink | dns-320l_firmware |
| dlink | dns-320l |
| dlink | dns-320lw_firmware |
| dlink | dns-320lw |
| dlink | dns-321_firmware |
| dlink | dns-321 |
| dlink | dnr-322l_firmware |
| dlink | dnr-322l |
| dlink | dns-323_firmware |
| dlink | dns-323 |
| dlink | dns-325_firmware |
| dlink | dns-325 |
| dlink | dns-326_firmware |
| dlink | dns-326 |
| dlink | dns-327l_firmware |
| dlink | dns-327l |
| dlink | dnr-326_firmware |
| dlink | dnr-326 |
| dlink | dns-340l_firmware |
| dlink | dns-340l |
| dlink | dns-343_firmware |
| dlink | dns-343 |
| dlink | dns-345_firmware |
| dlink | dns-345 |
| dlink | dns-726-4_firmware |
| dlink | dns-726-4 |
| dlink | dns-1100-4_firmware |
| dlink | dns-1100-4 |
| dlink | dns-1200-05_firmware |
| dlink | dns-1200-05 |
| dlink | dns-1550-04_firmware |
| dlink | dns-1550-04 |
References
Frequently Asked Questions
What is CVE-2024-7828? +
How severe is CVE-2024-7828? +
What products are affected by CVE-2024-7828? +
How do I check if I'm vulnerable to CVE-2024-7828? +
Related Vulnerabilities
zlib is a Ruby interface for the zlib compression/decompression library. Versions 3.0.0 and below, 3.1.0, 3.1.1, 3.2.0 and 3.2.1 contain …
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious …
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data …
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, …
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Newtec NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM …
An unauthenticated attacker on the WAN interface, with the ability to intercept Dynamic DNS (DDNS) traffic between DDNS services and …