CVE-2024-45697 D-Link WiFi router - Hidden Functionality
Attackers can remotely execute OS commands on D-Link routers via hidden Telnet service with hard-coded credentials when WAN is connected.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45697?
CVE-2024-45697 is a critical vulnerability in D-Link DIR-X4860 A1, published on 16 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials.
Weakness: CWE-912
Which versions are affected by CVE-2024-45697?
It affects 1 product.
Products include Dlink Dir-X4860 Firmware.
How do I fix CVE-2024-45697?
No fix has been published for CVE-2024-45697 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45697 being exploited?
There is no known exploitation of CVE-2024-45697 in the wild and no public exploit code.
Other vulnerabilities in D-Link DIR-X4860 A1
Sources
Also known as GHSA-wxf3-97x6-x82w.