Vulnerability · Published May 23, 2024 · Assigned by zdi

CVE-2024-5292D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

High 7.3

In plain English

A high-severity uncontrolled search path in Network Assistant from D-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.0)7.3High

Exploit odds (30 days)0.5%top 54.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DNACore service. The service loads a file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21426.

Affected products (as reported)

Vendor	Product	Versions
D-Link	Network Assistant	4.0.0.21

Weakness: CWE-427 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

ZDI-24-443 x_research-advisory