D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the TokenUtils class. The issue results from a hard-coded cryptographic key. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21991.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-447/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-24-447/ | Third Party Advisory |
Configurations
History
06 Aug 2025, 14:25
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:dlink:d-view_8:2.0.1.28:*:*:*:*:*:*:* | |
| First Time |
Dlink
Dlink d-view 8 |
|
| References | () https://www.zerodayinitiative.com/advisories/ZDI-24-447/ - Third Party Advisory |
23 May 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-23 22:15
Updated : 2025-08-06 14:25
NVD link : CVE-2024-5296
Mitre link : CVE-2024-5296
JSON object : View
Products Affected
dlink
- d-view_8
CWE
No CWE.