CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-38437

Medium Severity
Dlink
SVRS
30/100

CVSSv3
9.8/10

EPSS
0.00475/1

CVE-2024-38437 is a critical authentication bypass vulnerability in D-Link devices. This flaw allows unauthorized access through an alternate path or channel, bypassing normal authentication procedures. Despite a high CVSS score of 9.8, the SOCRadar Vulnerability Risk Score (SVRS) is 30, indicating a lower level of observed real-world risk compared to its potential severity. This D-Link vulnerability could permit attackers to gain administrative control. Attackers exploiting this vulnerability may be able to compromise devices, alter configurations or access sensitive data. Organizations using affected D-Link equipment should investigate this vulnerability, even with the low SVRS, to ensure the vulnerability does not become more prevalent in the threat landscape.

In The Wild
CVSS:3.1
AV:N
AC:L
PR:N
UI:N
S:U
C:H
I:H
A:H
2024-07-21

2024-08-29

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-38437 | D-Link DSL-225 BZ_1.00.16 authentication bypass
vuldb.com2024-07-21
CVE-2024-38437 | D-Link DSL-225 BZ_1.00.16 authentication bypass | A vulnerability was found in D-Link DSL-225 BZ_1.00.16 and classified as very critical. This issue affects some unknown processing. The manipulation leads to authentication bypass using alternate channel. The identification of this vulnerability is CVE-2024-38437. The attack may be initiated remotely. There is no exploit available.
cve-2024-38437
domains
urls
cves

Social Media

There is a new vulnerability with elevated criticality in D-Link DSL-225 (CVE-2024-38437) https://t.co/X3Sdx15Y7O
0
0
0
[CVE-2024-38437: CRITICAL] D-Link - CWE-288:Authentication Bypass Using an Alternate Path or Channel#cybersecurity,#vulnerability https://t.co/VDwsdITyiL https://t.co/lRYJPxfjhr
0
0
0

Affected Software

Configuration 1
TypeVendorProduct
OSDlinkdsl-225_firmware

References

ReferenceLink
[email protected]https://www.gov.il/en/Departments/faq/cve_advisories

CWE Details

CWE IDCWE NameDescription
CWE-288Authentication Bypass Using an Alternate Path or ChannelA product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-306Missing Authentication for Critical FunctionThe software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence