D-Link DIR-3040 prog.cgi Memory Leak DoS Vulnerability
CVE-2024-5294 Published on May 23, 2024

D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability
D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi program, which handles HNAP requests made to the lighttpd webserver listening on ports 80 and 443. The issue results from the lack of proper memory management when processing HTTP cookie values. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. . Was ZDI-CAN-21668.

NVD

Weakness Type

What is a Memory Leak Vulnerability?

The software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions. In some languages, developers are responsible for tracking memory allocation and releasing the memory. If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.

CVE-2024-5294 has been classified to as a Memory Leak vulnerability or weakness.


Products Associated with CVE-2024-5294

Want to know whenever a new CVE is published for D-Link Dir 3040 Firmware? stack.watch will email you.

D-Link Dir 3040 Firmware
 

Affected Versions

D-Link DIR-3040 Version 120B03 is affected by CVE-2024-5294

Exploit Probability

EPSS
0.08%
Percentile
23.84%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.