CVE-2024-34950
Published: 14 May 2024
Summary
CVE-2024-34950 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Dlink Dir-822\+ Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
D-Link DIR-822+ firmware version 1.0.5 contains a stack-based buffer overflow in the SetNetworkTomographySettings module. The flaw is tracked as CVE-2024-34950 with a CVSS 3.1 base score of 7.5 and is also associated with CWE-125.
An unauthenticated attacker can reach the affected module over the network without user interaction. Successful exploitation can produce a denial-of-service condition, consistent with the CVSS impact metrics that show no confidentiality or integrity loss but high availability impact.
Public references consist of a single Notion disclosure page; no vendor advisory, firmware update, or mitigation guidance is provided in the available information. The EPSS score reached a peak of 0.1914 and currently stands at 0.1448, indicating moderate and slightly declining exploitation interest since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-35126
Vulnerability details
D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.