PT-2024-8173 · D Link · D-Link Dsl6740C

Chiao-Lin Yu + 1 · Published 2024-11-11 · Updated 2024-11-15 · CVE-2024-11064

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: D-Link DSL6740C modem (affected versions not specified)

Description: The D-Link DSL6740C modem has an OS Command Injection issue, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. This vulnerability is related to the implementation of SSH and Telnet protocols in the modem's firmware, which fails to neutralize special elements used in the operating system command.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-09715

CVE-2024-11064

Affected Products

D-Link Dsl6740C

References · 16

• https://twcert.org.tw/en/cp-139-8230-11430-2.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11064 · Security Note
• https://twcert.org.tw/tw/cp-132-8223-f6da0-1.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09715 · Security Note
• https://t.me/true_secator/6423 · Telegram Post
• https://twitter.com/transilienceai/status/1857291777209733296 · Twitter Post
• https://bleepingcomputer.com/news/security/d-link-wont-fix-critical-bug-in-60-000-exposed-eol-modems · Note
• https://twitter.com/transilienceai/status/1857478506147623245 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1855946000118042710 · Twitter Post
• https://twitter.com/CVEnew/status/1855880959163510971 · Twitter Post
• https://t.me/cvedetector/10486 · Telegram Post
• https://twitter.com/transilienceai/status/1857478512753746357 · Twitter Post
• https://t.me/latest_high_impact_cve/1496 · Telegram Post
• https://t.me/cvenotify/101277 · Telegram Post
• https://t.me/cvenotify/101847 · Telegram Post