CVE-2024-8460 is an information disclosure vulnerability in the D-Link DNS-320 2.02b01 network-attached storage device, specifically within the web management interface's /cgi-bin/widget_api.cgi component. By manipulating the 'getHD/getSer/getSys' arguments, an unauthenticated remote attacker can extract sensitive system information. Despite a CVSS score of 5.9 (Medium) and a high attack complexity, exploitation is known to be difficult, though public exploit code exists. This vulnerability affects an end-of-life product, and there is no evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.02b01CPE matchmatch criteria | cpe:2.3:o:dlink:dns-320_firmware:2.02b01:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.