CVE-2024-11067: D-Link DSL6740C Path Traversal Vulnerability

CVE-2024-11067 Overview

CVE-2024-11067 is a path traversal vulnerability [CWE-23] affecting the D-Link DSL6740C modem. Unauthenticated remote attackers can exploit the flaw to read arbitrary system files on the device. The issue compounds because the modem's default administrative password derives from the device MAC address. Attackers who recover the MAC address through the file read primitive can then attempt authenticated logins using the predictable default credential. According to Bleeping Computer, D-Link has declined to issue a fix because the affected hardware has reached end-of-life status. Over 60,000 internet-exposed devices are reportedly affected.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from affected DSL6740C modems, recover MAC-derived default credentials, and gain administrative access to the device.

Affected Products

D-Link DSL6740C modem (hardware)
D-Link DSL6740C firmware (all versions)
End-of-life devices that will not receive vendor patches

Discovery Timeline

2024-11-11 - CVE-2024-11067 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11067

Vulnerability Analysis

The DSL6740C web management interface fails to sanitize file path inputs before passing them to file read operations. Attackers supply traversal sequences such as ../ to escape the intended directory and access files anywhere on the device filesystem. The vulnerability requires no authentication and can be triggered over the network via a single HTTP request.

Targets of interest include configuration files containing the device MAC address, password hashes, network configuration, and credentials for upstream services. Because the DSL6740C generates its default administrator password from the MAC address, recovering the MAC enables credential reconstruction. An attacker can then log in to the management interface if the operator never changed the default password.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-23]. The firmware accepts user-controlled path input in a request parameter and concatenates it into a filesystem path without canonicalization or directory containment checks. Traversal sequences are processed literally, allowing access to files outside the web root.

Attack Vector

Exploitation occurs over the network against the modem's HTTP management interface. An unauthenticated attacker sends a crafted request containing path traversal sequences in a file or resource parameter. The server returns the contents of the requested file. Devices with the management interface exposed to the public internet face direct exploitation risk. No verified public proof-of-concept code is currently catalogued in ExploitDB, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. See the TWCert Security Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2024-11067

Indicators of Compromise

HTTP requests to the modem management interface containing ../ or URL-encoded variants such as %2e%2e%2f in path or query parameters
Repeated requests targeting sensitive files such as /etc/passwd, configuration files, or files containing MAC address data
Successful administrative logins following anomalous file read activity from the same source IP
Outbound traffic from the modem to unexpected destinations following suspicious inbound activity

Detection Strategies

Inspect web server and firewall logs for path traversal patterns directed at the modem's management interface
Correlate file read attempts with subsequent authentication events from the same source address
Monitor for unauthenticated requests reaching internal modem management URLs from external networks

Monitoring Recommendations

Alert on any inbound traffic to TCP/80 or TCP/443 of DSL6740C devices from untrusted networks
Track configuration changes on the modem, including DNS settings, port forwarding rules, and administrative accounts
Capture and review network telemetry for anomalous DNS queries or routing changes originating from the modem

How to Mitigate CVE-2024-11067

Immediate Actions Required

Disconnect or replace the DSL6740C, as D-Link has confirmed no patch will be released for this end-of-life device
Change the default administrator password immediately if the modem must remain in service
Disable remote management and restrict access to the management interface to trusted LAN hosts only
Place the modem behind a network firewall that blocks inbound access to its management ports from the internet

Patch Information

D-Link will not release a patch for CVE-2024-11067. The DSL6740C is end-of-life, and the vendor recommends replacing affected devices. See the Bleeping Computer report and the TWCert Security Notice for vendor guidance.

Workarounds

Replace the DSL6740C with a supported modem from a vendor that provides active firmware updates
Segment the modem on an isolated network and restrict management plane access to a single jump host
Enforce a non-default administrator password that does not relate to the MAC address
Disable WAN-side access to HTTP, HTTPS, and any other management services on the device

bash

# Example: block external access to the modem management interface at an upstream firewall
iptables -A FORWARD -d <modem_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <modem_ip> -p tcp --dport 443 -j DROP