cbcvebase.
CVE-2024-45697
published 2024-09-16

CVE-2024-45697: Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote…

PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.03%
59.7th percentile
Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials.

Affected

4 ranges
VendorProductVersion rangeFixed in
d-linkdir-x4860_a1——
d-linkdir-x4860_a1——
dlinkdir-x4860_firmware——
dlinkdir-x4860_firmware——

Detection & IOCsextracted from sources · hover to see the quote

  • →Telnet service is activated on the WAN interface when the WAN port is physically plugged in — monitor for unexpected telnet (port 23) exposure on WAN-facing interfaces of affected D-Link routers (COVR-X1870, DIR-X4860, DIR-X5460) ↗
  • →Unauthorized remote login via hard-coded credentials over telnet — alert on successful telnet authentication attempts originating from external/WAN-side IP addresses targeting affected D-Link device models ↗
  • →Telnet service enablement is a hidden/undocumented functionality — inspect running services on affected D-Link routers for unexpected telnetd processes, especially when WAN link is active ↗
  • ·Affected models are COVR-X1870, DIR-X4860, and DIR-X5460; fixed firmware versions are v1.03B01, v1.04B05, and DIR-X5460A1_V1.11B04 respectively — devices running older firmware remain vulnerable to WAN-side telnet access via hard-coded credentials ↗
  • ·The vulnerability was publicly disclosed before patches were available on D-Link's standard 90-day schedule, increasing exploitation risk for unpatched devices in the wild ↗
  • ·D-Link devices are commonly targeted by malware botnets; the combination of WAN-exposed telnet and hard-coded credentials makes unpatched devices a high-priority target for automated exploitation ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.