Advisory Details

May 14th, 2024

(0Day) D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

ZDI-24-443
ZDI-CAN-21426

CVE ID CVE-2024-5292
CVSS SCORE 7.3, AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
AFFECTED VENDORS D-Link
AFFECTED PRODUCTS Network Assistant
VULNERABILITY DETAILS

This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DNACore service. The service loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.

ADDITIONAL DETAILS

08/28/23 – ZDI reported the vulnerability to the vendor
08/24/23 – The vendor communicated that the cases would be fixed in Q4, 2023 release
05/01/24 – ZDI notified the vendor of the intention to publish the case as 0-day advisory on 05/14/24

-- Mitigation: On May 16, 2024, the vendor informed ZDI about v 4.0.0.21 EOL/EOS announcement
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10388


DISCLOSURE TIMELINE
  • 2023-08-02 - Vulnerability reported to vendor
  • 2024-05-14 - Coordinated public release of advisory
  • 2024-05-24 - Advisory Updated
CREDIT Xavier DANEST
BACK TO ADVISORIES