CVE-2024-10916
📋 TL;DR
This vulnerability allows remote attackers to access sensitive information through an unauthenticated HTTP GET request to /xml/info.xml on affected D-Link NAS devices. The information disclosure could reveal system details that might aid further attacks. All users of affected D-Link NAS models with firmware up to October 28, 2024 are vulnerable.
💻 Affected Systems
- D-Link DNS-320
- DNS-320LW
- DNS-325
- DNS-340L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain sensitive system information that could be used to plan targeted attacks, potentially leading to full system compromise through chained vulnerabilities.
Likely Case
Unauthenticated attackers access system information including version details, configuration data, and potentially credentials or other sensitive data exposed in the XML response.
If Mitigated
Information exposure limited to non-sensitive system details that don't enable further exploitation.
🎯 Exploit Status
Exploit requires only a simple HTTP GET request to the vulnerable endpoint. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
Check D-Link website for firmware updates. If available, download latest firmware and apply through web interface.
🔧 Temporary Workarounds
Block access to /xml/info.xml
linuxConfigure firewall or web server to block access to the vulnerable endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/xml/info.xml" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/xml/info.xml" --algo bm -j DROP
Restrict NAS access
allLimit NAS access to trusted networks only
Configure firewall rules to allow only specific IP ranges to access NAS management interface
🧯 If You Can't Patch
- Remove affected devices from internet-facing networks immediately
- Implement network segmentation to isolate NAS devices from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[NAS_IP]/xml/info.xml and check if sensitive information is returnedCheck Version:
Check firmware version in NAS web interface under System > FirmwareVerify Fix Applied:
After applying workarounds, verify the endpoint returns access denied or no sensitive data📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /xml/info.xml from untrusted sources
- Unusual access patterns to XML endpoints
Network Indicators:
- HTTP traffic to NAS devices containing /xml/info.xml in URI
- External IPs accessing NAS management interfaces
SIEM Query:
source="nas_logs" AND uri="/xml/info.xml" AND src_ip NOT IN (trusted_networks)