A vulnerability, which was classified as problematic, was found in D-Link DIR-823G 1.0.2B05_20181207. Affected is some unknown processing of the component Configuration File Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded configuration files contain plaintext user passwords.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-44408 since 08/21/2024. The exploitability is told to be easy. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/11/2024). The MITRE ATT&CK project declares the attack technique as T1592.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-276349, VDB-276706, VDB-276951 and VDB-277228 are related to this item.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-823G

Version

• 1.0.2B05_20181207

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion