CVE-2024-6045

CWE-798 — Hard-coded CredentialsCWE-9123 documents3 sources
Severity
8.8HIGH
EPSS
7.6%
top 8.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
D-link E15D-link E30D-link G403+12 more
Timeline
PublishedJun 17

Description

Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages15 packages

▶CVEListV5d-link/e15earlier — 1.20.01
▶CVEListV5d-link/e30earlier — 1.10.02
▶CVEListV5d-link/m18earlier — 1.10.01
▶CVEListV5d-link/m30earlier — 1.10.02
▶CVEListV5d-link/m32earlier — 1.10.02

🔴Vulnerability Details

2
GHSA
GHSA-m8cg-23fc-95h8: Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor↗2024-06-17
▶
CVEList
D-Link router - Hidden Backdoor↗2024-06-17
▶