PT-2024-7559 · D Link · D-Link Dsl-6740C

Chiao-Lin Yu + 1 · Published 2024-10-30 · Updated 2024-11-01 · CVE-2024-48271

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D-Link DSL-6740C version 6.TR069.20211230

Description The issue is related to the use of weak password requirements in the D-Link DSL-6740C router's software component. This could allow a remote attacker to escalate their privileges. The vulnerability is due to the use of insecure default credentials for Administrator access, which could be exploited by attackers to bypass authentication and gain elevated access to the device through a brute-force attack.

Recommendations For D-Link DSL-6740C version 6.TR069.20211230, update the firmware as soon as possible and change the default credentials to secure ones. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-1392

CWE-1391

CWE-521

Related Identifiers

BDU:2024-08960

CVE-2024-48271

Affected Products

D-Link Dsl-6740C

References · 11

• 🔥 https://gist.github.com/stevenyu113228/e264c145d6e6e6b59cf53fddc27409ad#1--predictable-administrator-credentials-in-d-link-dsl6740c-modem · Exploit
• https://bdu.fstec.ru/vul/2024-08960 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-48271 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48271 · Vendor Advisory
• https://twitter.com/oktsec/status/1851936576810426517 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-48271 · Note
• https://twitter.com/VulmonFeeds/status/1851811786720186520 · Twitter Post
• https://vuldb.com/?id.282566 · Note
• https://twitter.com/vuldb/status/1851898792095944981 · Twitter Post
• https://dlink.com/en/security-bulletin · Note
• https://t.me/cvedetector/9459 · Telegram Post