Alerts
Multiple Vulnerabilities in D-Link Wireless Routers
17 September 2024
D-Link has released security updates to address multiple vulnerabilities (CVE-2024-45694, CVE-2024-45695, CVE-2024-45696, CVE-2024-45697 and CVE-2024-45698), three of which are critical, affecting their wireless routers.
The vulnerabilities are:
• CVE-2024-45694 and CVE-2024-45695: Successful exploitation of the stacked-based overflow vulnerability could allow an unauthenticated remote attacker to perform arbitrary code execution on the affected device. The vulnerabilities have a Common Vulnerability Scoring System (CVSSv3) score of 9.8 out of 10.
• CVE-2024-45696: Successful exploitation of the vulnerability could allow an unauthenticated remote attacker to enable the telnet service and login with hard-coded credentials within the local network.
• CVE-2024-45697: Successful exploitation of the vulnerability could allow an unauthenticated remote attacker to gain access to the affected device and execute Operating System (OS) commands with hard-coded credentials. The vulnerability has a Common Vulnerability Scoring System (CVSSv3) score of 9.8 out of 10.
• CVE-2024-45698: Successful exploitation of the input validation vulnerability could allow an unauthenticated remote attacker to access telnet with hard-coded credentials and execute arbitrary OS commands on the affected device.
The vulnerabilities affect the following products:
• COVR-X1870 versions v1.02 and earlier
• DIR-X4860 versions v1.04B04_Hot-Fix and earlier
• DIR-X5460 versions v1.11B01_Hot-Fix or earlier
Users and administrators of affected products are advised to update to the latest versions immediately.
More information is available here:
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10412