A vulnerability was found in D-Link DIR-3040us A1 1.20b03a and classified as critical. Affected by this issue is an unknown function of the component FTP Server. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. Any user having read/write access to ftp server can write directly to ram causing buffer overflow if file or files uploaded are greater than available ram. Ftp server allows change of directory to root which is one level up than root of usb flash directory. During upload ram is getting filled and causing system resource exhaustion (no free memory) which causes system to crash and reboot.

This vulnerability is handled as CVE-2024-27619 since 02/26/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 03/29/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-202725, VDB-210420, VDB-212013 and VDB-218468 are pretty similar.

Productinfo

Type

• Router Operating System

Vendor

• D-Link

Name

• DIR-3040us A1

Version

• 1.20b03a

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion