cbcvebase.
CVE-2024-57045
published 2025-02-18

CVE-2024-57045: A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An…

PriorityP179critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
32.26%
98.1th percentile
A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page.

Affected

1 ranges
VendorProductVersion rangeFixed in
dlinkdir-859_a3_firmware< 1.051.05

Detection & IOCsextracted from sources · hover to see the quote

path/getcfg.php↗
commandPOST /getcfg.php HTTP/1.1
otherSERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1
  • →Detect unauthenticated POST requests to /getcfg.php with body parameter SERVICES=DEVICE.ACCOUNT and AUTHORIZED_GROUP=1 (newline-injected), which bypasses authentication on D-Link DIR-859 routers.
  • →Match Content-Type: text/xml in the response from /getcfg.php as a secondary indicator of a successful exploitation attempt.
  • →Use Shodan query 'title:"D-Link"' or FOFA query 'title="D-Link"' to identify potentially exposed D-Link DIR-859 devices on the internet.
  • ·The authentication bypass relies on newline injection (%0a) in the POST body to append AUTHORIZED_GROUP=1 after SERVICES=DEVICE.ACCOUNT, effectively forging an authorized request. Detection rules must account for URL-encoded newline characters in the POST body.
  • ·Affected firmware is D-Link DIR-859 version A3 1.05 and earlier. Devices running newer firmware may not be vulnerable. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.