TI-2024-05601 Aliases CVE-2024-6044 GHSA-rr4p-qrv5-g999

D-Link router - Arbitrary File Reading

LOW 29CWE-22Published 2024-06-17 · Updated 2024-08-01

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Certain models of D-Link wireless routers have a path traversal vulnerability. Unauthenticated attackers on the same local area network can read arbitrary system files by manipulating the URL.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0038 32nd percentileScored 2026-11-07

Fix Fixed G403 (D-Link): 1.10.01G415 (D-Link): 1.10.01+13 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
D-Link	G403	earlier to before 1.10.01	1.10.01	Patch available	CNA
D-Link	G415	earlier to before 1.10.01	1.10.01	Patch available	CNA
D-Link	G416	earlier to before 1.10.01	1.10.01	Patch available	CNA
D-Link	M18	earlier to before 1.10.01	1.10.01	Patch available	CNA
D-Link	R03	earlier to before 1.10.01	1.10.01	Patch available	CNA
D-Link	R04	earlier to before 1.10.01	1.10.01	Patch available	CNA
D-Link	R12	earlier to before 1.10.01	1.10.01	Patch available	CNA
D-Link	R18	earlier to before 1.10.01	1.10.01	Patch available	CNA
D-Link	E30	earlier to before 1.10.02	1.10.02	Patch available	CNA
D-Link	M30	earlier to before 1.10.02	1.10.02	Patch available	CNA
D-Link	M32	earlier to before 1.10.02	1.10.02	Patch available	CNA
D-Link	M60	earlier to before 1.10.02	1.10.02	Patch available	CNA
D-Link	R32	earlier to before 1.10.02	1.10.02	Patch available	CNA
D-Link	E15	earlier to before 1.20.01	1.20.01	Patch available	CNA
D-Link	R15	earlier to before 1.20.01	1.20.01	Patch available	CNA

G403 VendorD-Link Affected earlier to before 1.10.01 Fixed in 1.10.01 Patch available CNA
G415 VendorD-Link Affected earlier to before 1.10.01 Fixed in 1.10.01 Patch available CNA
G416 VendorD-Link Affected earlier to before 1.10.01 Fixed in 1.10.01 Patch available CNA
M18 VendorD-Link Affected earlier to before 1.10.01 Fixed in 1.10.01 Patch available CNA
R03 VendorD-Link Affected earlier to before 1.10.01 Fixed in 1.10.01 Patch available CNA
R04 VendorD-Link Affected earlier to before 1.10.01 Fixed in 1.10.01 Patch available CNA
R12 VendorD-Link Affected earlier to before 1.10.01 Fixed in 1.10.01 Patch available CNA
R18 VendorD-Link Affected earlier to before 1.10.01 Fixed in 1.10.01 Patch available CNA
E30 VendorD-Link Affected earlier to before 1.10.02 Fixed in 1.10.02 Patch available CNA
M30 VendorD-Link Affected earlier to before 1.10.02 Fixed in 1.10.02 Patch available CNA
M32 VendorD-Link Affected earlier to before 1.10.02 Fixed in 1.10.02 Patch available CNA
M60 VendorD-Link Affected earlier to before 1.10.02 Fixed in 1.10.02 Patch available CNA
R32 VendorD-Link Affected earlier to before 1.10.02 Fixed in 1.10.02 Patch available CNA
E15 VendorD-Link Affected earlier to before 1.20.01 Fixed in 1.20.01 Patch available CNA
R15 VendorD-Link Affected earlier to before 1.20.01 Fixed in 1.20.01 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:dlink:g416_firmware::::::::	—	—	D-Link Japan K.K.

cpe:2.3:o:dlink:g416_firmware:*:*:*:*:*:*:*:* Versions — — ·D-Link Japan K.K.

Remediation

Fix · CNA G403 (D-Link) Fixed in 1.10.01
Fix · CNA G415 (D-Link) Fixed in 1.10.01
Fix · CNA G416 (D-Link) Fixed in 1.10.01
Fix · CNA M18 (D-Link) Fixed in 1.10.01
Fix · CNA R03 (D-Link) Fixed in 1.10.01
Fix · CNA R04 (D-Link) Fixed in 1.10.01
Fix · CNA R12 (D-Link) Fixed in 1.10.01
Fix · CNA R18 (D-Link) Fixed in 1.10.01
Fix · CNA E30 (D-Link) Fixed in 1.10.02
Fix · CNA M30 (D-Link) Fixed in 1.10.02
Fix · CNA M32 (D-Link) Fixed in 1.10.02
Fix · CNA M60 (D-Link) Fixed in 1.10.02
Fix · CNA R32 (D-Link) Fixed in 1.10.02
Fix · CNA E15 (D-Link) Fixed in 1.20.01
Fix · CNA R15 (D-Link) Fixed in 1.20.01

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2024-06-17
D-Link E15, E30 and 13 more products — supportannouncement.us.dlink.com/security/publication.aspx?…
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-05602 D-Link router - Hidden BackdoorPriority MEDIUM 55
Show all 2 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-6044
2026-10-03 Alias added: GHSA-rr4p-qrv5-g999

References

Advisory 3

TI-2024-03070 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection KEVCVSS 3.1CRITICAL 9.8
TI-2024-03069 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials KEVCVSS 3.1CRITICAL 9.8
TI-2024-00708 D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal KEVCVSS 3.1CRITICAL 9.8
TI-2023-10693 OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to… KEVCVSS 3.1CRITICAL 9.8
TI-2022-17249 D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
TI-2022-09657 D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE)… KEVCVSS 3.1CRITICAL 9.8

See all 979 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences