CVE-2024-40505

CRITICAL EPSS 34.8%

Published Jul 16, 20241y ago · Modified Jun 17, 20262w ago

9.3 CVSS 3.1

Critical

Published Jul 16, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 allows a local attacker to escalate privileges via the hedwig.cgi component.

Base Score

9.3

Exploitability

2.5

Impact

6.0

Vector string

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Changed

Confidentiality High

Integrity High

Availability High

EPSS Exploit Probability

34.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

CWE-35

Vendor	Product	Version	Range
dlink	dap-1650_firmware	1.03	any
dlink	dap-1650	*	any

coldwx.github.io https://coldwx.github.io/CVE-2024-40505.html

Third Party Advisory
supportannouncement.us.dlink.com https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10266

Vendor Advisory

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.