TI-2024-03750 Aliases CVE-2024-4021 GHSA-qpjq-mm4r-7g3r

Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Configuration Setting ndmComponents.js information disclosure

LOW 25CWE-200Published 2024-04-21 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /ndmComponents.js of the component Configuration Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-261673 was assigned to this vulnerability. NOTE: The vendor is aware of this issue and plans to fix it by the end of 2024.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00572 47th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Keenetic	KN-1010	1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15	—	No fix listed	CNA
Keenetic	KN-1410	1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15	—	No fix listed	CNA
Keenetic	KN-1711	1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15	—	No fix listed	CNA
Keenetic	KN-1810	1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15	—	No fix listed	CNA
Keenetic	KN-1910	1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15	—	No fix listed	CNA

KN-1010 VendorKeenetic Affected 1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15 Fixed in — No fix listed CNA
KN-1410 VendorKeenetic Affected 1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15 Fixed in — No fix listed CNA
KN-1711 VendorKeenetic Affected 1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15 Fixed in — No fix listed CNA
KN-1810 VendorKeenetic Affected 1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15 Fixed in — No fix listed CNA
KN-1910 VendorKeenetic Affected 1.6.49; 3.5.68; 3.7.77; 4.0.2.215; 4.1.2.14; 4.1.2.15 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-4021
2026-10-03 Alias added: GHSA-qpjq-mm4r-7g3r

References

Exploit 1

https://netsecfish.notion.site/Information-Disclosure-in-Keenetic-Router-d4a12a499cef4acf80e191bdaf20c151?pvs=4

TI-2024-03751 Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js information disclosure CVSS 3.1MEDIUM 5.3
TI-2025-35214 CRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take… CVSS 3.1MEDIUM 6.5
TI-2025-35215 Cross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page… CVSS 3.1MEDIUM 6.1
TI-2025-35216 Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences