CVE-2024-42812

critical · 9.8

In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. Attackers who successfully exploit this vulnerability can cause the remote target device to crash or execute arbitrary commands.

9.8

CVSS

15.5%

EPSS (exploit prob.)

97th

EPSS percentile

2024-08-19

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-120

Affected products

Vendor	Product	Affected versions
dlink	dir-860l_firmware	2.0.3
dlink	dir-860l	all versions

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/XiaoCurry/574ed9c2b0d12cd0b45399116d82121c
https://www.dlink.com/en/security-bulletin/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-42812