D-Link D-View 2.0.1.28 queryDeviceCustomMonitorResult routine

Summaryinfo

A vulnerability was found in D-Link D-View 2.0.1.28. It has been classified as very critical. This affects the function queryDeviceCustomMonitorResult. Performing a manipulation results in routine. This vulnerability was named CVE-2024-5298. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as very critical has been found in D-Link D-View 2.0.1.28. This affects the function queryDeviceCustomMonitorResult. The manipulation with an unknown input leads to a routine vulnerability. CWE is classifying the issue as CWE-749. The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the queryDeviceCustomMonitorResult method. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21842.

It is possible to read the advisory at zerodayinitiative.com. This vulnerability is uniquely identified as CVE-2024-5298 since 05/23/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/06/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• D-Link

Name

• D-View

Version

• 2.0.1.28

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion