PT-2024-1919 · D Link · D-Link Dir-600M C1

Dmknght · Published 2024-02-22 · Updated 2024-12-17 · CVE-2024-1786

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions D-Link DIR-600M C1 version 3.08

Description A critical issue has been found in the Telnet Service component of the affected device, caused by a buffer overflow when manipulating the username argument. This can be exploited remotely, potentially allowing an attacker to execute arbitrary code. The issue affects products that are no longer supported by the maintainer and should be retired and replaced.

Recommendations For D-Link DIR-600M C1 version 3.08, it is recommended to retire and replace the device as it is no longer supported by the maintainer. As a temporary workaround, consider disabling the Telnet Service until a replacement can be implemented. Restrict access to the device to minimize the risk of exploitation. Avoid using the username argument in the Telnet Service until the issue is resolved by replacing the device.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2024-01707

CVE-2024-1786

Affected Products

D-Link Dir-600M C1

References · 10

• 🔥 https://gist.github.com/dmknght/269d90e17713bbd34e48c50f5c5284a2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1786 · Security Note
• https://bdu.fstec.ru/vul/2024-01707 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1786 · Vendor Advisory
• https://twitter.com/CVEnew/status/1760832009738269047 · Twitter Post
• https://vuldb.com/?ctiid.254576 · Note
• https://twitter.com/cracbot/status/1761610569386254501 · Twitter Post
• https://t.me/cvenotify/104600 · Telegram Post
• https://t.me/cvenotify/72268 · Telegram Post
• https://vuldb.com/?id.254576 · Note