CVE-2024-5296
Assigner: zdi
Published: 2024-05-23T21:29:58.566Z
State: PUBLISHED
title: D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability
descriptions: value: D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the TokenUtils class. The issue results from a hard-coded cryptographic key. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21991.
affected: vendor: D-Link
product: D-View
versions: version: 2.0.1.28
status: affected
defaultStatus: unknown
problemTypes: descriptions: cweId: CWE-321
description: CWE-321: Use of Hard-coded Cryptographic Key
type: CWE
dateAssigned: 2024-05-23T16:28:51.915-05:00
datePublic: 2024-05-14T10:21:23.062-05:00
source: value: Piotr Bazydlo (@chudypb) of Trend Micro Zero Day Initiative
metrics: format: CVSS
cvssV3_0: version: 3.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL