Vulnerability · Published Apr 21, 2024 · Assigned by VulDB
CVE-2024-4022Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js information disclosure
Medium 5.3
In plain English
A medium-severity information exposure in KN-1010 from Keenetic. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Official description
A vulnerability was found in Keenetic KN-1010, KN-1410, KN-1711, KN-1810 and KN-1910 up to 4.1.2.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /version.js of the component Version Data Handler. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-261674 is the identifier assigned to this vulnerability. NOTE: The vendor is aware of this issue and plans to fix it by the end of 2024.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Keenetic | KN-1010 | 1.6.493.5.683.7.774.0.2.2154.1.2.144.1.2.15 |
| Keenetic | KN-1410 | 1.6.493.5.683.7.774.0.2.2154.1.2.144.1.2.15 |
| Keenetic | KN-1711 | 1.6.493.5.683.7.774.0.2.2154.1.2.144.1.2.15 |
| Keenetic | KN-1810 | 1.6.493.5.683.7.774.0.2.2154.1.2.144.1.2.15 |
| Keenetic | KN-1910 | 1.6.493.5.683.7.774.0.2.2154.1.2.144.1.2.15 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- VDB-261674 | Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js information disclosure vdb-entry
- VDB-261674 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #316276 | Keenetic Omni Router, Carrier Router, Viva Router, Ultra Router, Ultra II Router, Giga Router * 4.1.2.15/4.1.2.14/4.0.2.215/3.7.77/3.5.68/1.6.49 Information Disclosure third-party-advisory
- https://netsecfish.notion.site/Information-Disclosure-in-Keenetic-Router-d4a12a499cef4acf80e191bdaf20c151?pvs=4 exploit