Skip to content
OpenAdvisories
High WID-SEC-2024-2146 5 CVEs

D-LINK Router: Mehrere Schwachstellen ermöglichen Codeausführung

Published Sep 15, 2024 · Updated Sep 15, 2024 · de-DE

Vendor: D-Link Product: Router

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in D-LINK Router ausnutzen, um beliebigen Programmcode auszuführen.

Product

Router der Firma D-LINK enthalten eine Firewall und in der Regel eine WLAN-Schnittstelle. Die Geräte sind hauptsächlich für private Anwender und Kleinunternehmen konzipiert.

Vulnerabilities 5

  • Critical 9.8
    CVE-2024-45694

    D-Link WiFi router - Stack-based Buffer Overflow

    The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.

    D-Link DIR-X4860 A1 DIR-X5460 A1 Network devices
  • Critical 9.8
    CVE-2024-45695

    D-Link WiFi router - Stack-based Buffer Overflow

    The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.

    D-Link DIR-X4860 A1 Network devices
  • Critical 9.8
    CVE-2024-45697

    D-Link WiFi router - Hidden Functionality

    Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials.

    D-Link DIR-X4860 A1 Network devices
  • Critical 9.8
    CVE-2024-45698

    D-Link WiFi router - OS Command Injection

    Certain models of D-Link wireless routers do not properly validate user input in the telnet service, allowing unauthenticated remote attackers to use hard-coded credentials to log into telnet and inject arbitrary OS commands, which can then be executed on the…

    D-Link DIR-X4860 A1 Network devices
  • High 8.8
    CVE-2024-45696

    D-Link WiFi router - Hidden Functionality

    Certain models of D-Link wireless routers contain hidden functionality. By sending specific packets to the web service, the attacker can forcibly enable the telnet service and log in using hard-coded credentials. The telnet service enabled through this method…

    D-Link DIR-X4860 A1 COVR-X1870 Network devices

Revision history

  1. #1

    Initiale Fassung

References