cbcvebase.
CVE-2024-45694
published 2024-09-16

CVE-2024-45694: The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote…

PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.91%
77.4th percentile
The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.

Affected

12 ranges
VendorProductVersion rangeFixed in
d-linkdir-x4860_a1——
d-linkdir-x4860_a1——
d-linkdir-x5460_a1——
d-linkdir-x5460_a1——
d-linkdir-x5460_a1——
d-linkdir-x5460_a1——
dlinkdir-x4860_firmware——
dlinkdir-x4860_firmware——
dlinkdir-x5460_firmware——
dlinkdir-x5460_firmware——
dlinkdir-x5460_firmware——
dlinkdir-x5460_firmware——

Detection & IOCsextracted from sources · hover to see the quote

  • →CVE-2024-45694 is a stack-based buffer overflow in the web service of affected D-Link routers; target unauthenticated HTTP requests to the web service interface of COVR-X1870, DIR-X4860, and DIR-X5460 models ↗
  • →No authentication is required to trigger the vulnerability; monitor for anomalous or oversized requests to the router web service from external/WAN-side sources on affected D-Link models ↗
  • →D-Link routers are commonly targeted by malware botnets; prioritize detection and patching on internet-exposed COVR-X1870, DIR-X4860, and DIR-X5460 devices ↗
  • ·Patched firmware versions are available; unpatched devices remain exploitable. Verify firmware version on all affected models: COVR-X1870 (fix: v1.03B01), DIR-X4860 (fix: v1.04B05), DIR-X5460 (fix: DIR-X5460A1_V1.11B04) ↗
  • ·The vulnerability was publicly disclosed before patches were available on D-Link's standard 90-day schedule, increasing the window of exposure for unpatched devices ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.