VAR-200412-0052

Vulnerability from variot - Updated: 2025-04-03 22:26

Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO router running firmware 2.60B2, and DI-624, allows remote attackers to inject arbitrary script or HTML via the DHCP HOSTNAME option in a DHCP request. It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log. An attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device. The injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible. Although only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200412-0052",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "di-614\\+",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "d link",
        "version": "2.30"
      },
      {
        "model": "di-704p",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "d link",
        "version": "2.60b2"
      },
      {
        "model": "di-624",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "dlink",
        "version": "1.28"
      },
      {
        "model": "di-624",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "d link",
        "version": "1.28"
      },
      {
        "model": "dl-704 b2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.60"
      },
      {
        "model": "dl-704 b6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.56"
      },
      {
        "model": "dl-704 b5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.56"
      },
      {
        "model": "di-624 soho router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "1.28"
      },
      {
        "model": "di-614+",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.18"
      },
      {
        "model": "di-614+",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.10"
      },
      {
        "model": "di-614+ f",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.0"
      },
      {
        "model": "di-614+ 3g",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.0"
      },
      {
        "model": "di-614+",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.03"
      },
      {
        "model": "di-614+",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "d link",
        "version": "2.0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "10587"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0615"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "c3rb3r",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2004-0615",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.1,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "CVE-2004-0615",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.1,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 4.9,
            "id": "VHN-9045",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:H/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2004-0615",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200412-032",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-9045",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9045"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0615"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site scripting (XSS) vulnerability in D-Link DI-614+ SOHO router running firmware 2.30, and DI-704 SOHO router running firmware 2.60B2, and DI-624, allows remote attackers to inject arbitrary script or HTML via the DHCP HOSTNAME option in a DHCP request. It is reported that the DI-614+, DI-704, and the DI-624 are susceptible to an HTML injection vulnerability in their DHCP log. \nAn attacker who has access to the wireless, or internal network segments of the router can craft malicious DHCP hostnames, that when sent to the router, will be logged for later viewing by the administrator of the device. \nThe injected HTML can be used to cause the administrator to make unintended changes to the configuration of the router. Other attacks may be possible. \nAlthough only the DI-614+, DI-704, and the DI-624 are reported vulnerable, code reuse across devices is common and other products may also be affected",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2004-0615"
      },
      {
        "db": "BID",
        "id": "10587"
      },
      {
        "db": "VULHUB",
        "id": "VHN-9045"
      }
    ],
    "trust": 1.26
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-9045",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9045"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "10587",
        "trust": 2.0
      },
      {
        "db": "SECUNIA",
        "id": "11919",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1010562",
        "trust": 1.7
      },
      {
        "db": "OSVDB",
        "id": "7211",
        "trust": 1.7
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0615",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032",
        "trust": 0.6
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-77959",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "24226",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-9045",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9045"
      },
      {
        "db": "BID",
        "id": "10587"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0615"
      }
    ]
  },
  "id": "VAR-200412-0052",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9045"
      }
    ],
    "trust": 0.53333334
  },
  "last_update_date": "2025-04-03T22:26:17.919000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "A variety of D-Link products Vulnerability fixes",
        "trust": 0.6,
        "url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=234979"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2004-0615"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.securityfocus.com/bid/10587"
      },
      {
        "trust": 1.7,
        "url": "http://archives.neohapsis.com/archives/bugtraq/2004-07/0014.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.osvdb.org/7211"
      },
      {
        "trust": 1.7,
        "url": "http://securitytracker.com/id?1010562"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/11919"
      },
      {
        "trust": 1.7,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16468"
      },
      {
        "trust": 1.6,
        "url": "http://marc.info/?l=bugtraq\u0026m=108786257609932\u0026w=2"
      },
      {
        "trust": 1.6,
        "url": "http://marc.info/?l=bugtraq\u0026m=108797273127182\u0026w=2"
      },
      {
        "trust": 0.3,
        "url": "http://www.d-link.com/"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/366615"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/367855"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/366826"
      },
      {
        "trust": 0.1,
        "url": "http://marc.info/?l=bugtraq\u0026amp;m=108786257609932\u0026amp;w=2"
      },
      {
        "trust": 0.1,
        "url": "http://marc.info/?l=bugtraq\u0026amp;m=108797273127182\u0026amp;w=2"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-9045"
      },
      {
        "db": "BID",
        "id": "10587"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0615"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-9045"
      },
      {
        "db": "BID",
        "id": "10587"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0615"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2004-12-06T00:00:00",
        "db": "VULHUB",
        "id": "VHN-9045"
      },
      {
        "date": "2004-06-21T00:00:00",
        "db": "BID",
        "id": "10587"
      },
      {
        "date": "2004-12-06T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      },
      {
        "date": "2004-12-06T05:00:00",
        "db": "NVD",
        "id": "CVE-2004-0615"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-07-11T00:00:00",
        "db": "VULHUB",
        "id": "VHN-9045"
      },
      {
        "date": "2004-06-21T00:00:00",
        "db": "BID",
        "id": "10587"
      },
      {
        "date": "2023-04-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      },
      {
        "date": "2025-04-03T01:03:51.193000",
        "db": "NVD",
        "id": "CVE-2004-0615"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Multiple D-Link products Security hole",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200412-032"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.