CVE-2024-45372

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. Viewing a malicious page while logging in to the web management page of the affected product may lead the user to perform unintended operations such as changing the login password, etc.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
PLANEX COMMUNICATIONS INC.	MZK-DP300N	firmware versions 1.04 and earlier

References

https://jvn.jp/en/jp/JVN81966868/Third Party Advisory
https://www.planex.co.jp/support/download/mzk-dp300n/Product

Timeline

Published: Sep 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-453738.8Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator.CVE-2024-453746.5The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption ke CVE-2024-45387.5IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain a user's eve CVE-2024-453825.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through out-of-bounds write.CVE-2024-453835.0A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36 CVE-2024-453845.3Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. Thi CVE-2024-453856.1A vulnerability has been identified in Industrial Edge Management OS (IEM-OS) (All versions). Affected components are vulnerable to reflecte CVE-2024-453868.8A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 2), SIMATIC PCS CVE-2024-453878.8An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "fede CVE-2024-453887.5Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/api/v2/simulation` POS CVE-2024-453895.4Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first scri CVE-2024-45396.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5