CVE-2019-14335 Denial of service in n/a

Medium 5.5 Published 8 Aug 2019 Updated 5 Aug 2024

An authenticated attacker can cause a denial of service and reboot D-Link access points via a specific admin.cgi URI.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-14335?

CVE-2019-14335 is a medium-severity denial of service vulnerability in n/a, published on 8 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of the AP via the admin.cgi?action=%s URI.

Which versions are affected by CVE-2019-14335?

It affects 2 products.

Products include Dlink 6600-Ap Firmware, Dlink Dwl-3600ap Firmware.

How do I fix CVE-2019-14335?

No fix has been published for CVE-2019-14335 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-14335 being exploited?

There is no known exploitation of CVE-2019-14335 in the wild and no public exploit code.

Sources

Also known as GHSA-jh98-36c6-c543.