The SentinelOne Annual Threat Report - A Defenders Guide from the FrontlinesThe SentinelOne Annual Threat ReportGet the Report
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2024-45694

CVE-2024-45694: D-Link DIR-X5460 Buffer Overflow Flaw

CVE-2024-45694 is a stack-based buffer overflow vulnerability in D-Link DIR-X5460 firmware that enables unauthenticated attackers to execute arbitrary code remotely. This article covers technical details, impact, and mitigation.

Published: April 15, 2026

CVE-2024-45694 Overview

The web service of certain D-Link wireless router models contains a Stack-based Buffer Overflow vulnerability (CWE-121), which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device. This critical firmware vulnerability affects the DIR-X5460 and DIR-X4860 wireless router product lines, exposing home and small business networks to complete device compromise without requiring authentication.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on affected D-Link routers, potentially gaining full control of the device and pivoting to attack internal network resources.

Affected Products

  • D-Link DIR-X5460 (Hardware Revision A1) with Firmware versions 1.01, 1.02, 1.04, and 1.10
  • D-Link DIR-X4860 (Hardware Revision A1) with Firmware versions 1.00 and 1.04
  • D-Link DIR-X5460 Firmware
  • D-Link DIR-X4860 Firmware

Discovery Timeline

  • 2024-09-16 - CVE-2024-45694 published to NVD
  • 2024-09-17 - Last updated in NVD database

Technical Details for CVE-2024-45694

Vulnerability Analysis

This vulnerability is classified as a Stack-based Buffer Overflow (CWE-121), a memory corruption flaw that occurs when user-supplied data is copied to a fixed-size stack buffer without proper bounds checking. In the context of the D-Link router web service, this allows an attacker to overwrite adjacent memory on the stack, including critical values such as saved return addresses and function pointers.

The attack can be initiated remotely over the network without any authentication requirements, and no user interaction is necessary for successful exploitation. An attacker who successfully exploits this vulnerability gains complete control over the affected device with the ability to execute arbitrary code, potentially leading to full device compromise, installation of persistent backdoors, or use of the router as a pivot point for further network attacks.

Root Cause

The root cause of CVE-2024-45694 lies in improper input validation within the web service component of the affected D-Link router firmware. When processing HTTP requests, the web service fails to properly validate the length of user-supplied input before copying it to a stack-allocated buffer. This boundary condition error allows an attacker to provide oversized input that exceeds the buffer's allocated space, corrupting adjacent stack memory and enabling control flow hijacking.

Attack Vector

The vulnerability is exploited via the network attack vector, specifically through the router's web management interface. An unauthenticated attacker can craft malicious HTTP requests containing oversized data fields that overflow the vulnerable stack buffer. By carefully constructing the overflow payload, the attacker can overwrite the saved return address on the stack, redirecting program execution to attacker-controlled code or existing executable sequences (ROP gadgets) within the firmware.

The exploitation process typically involves:

  1. Identifying the vulnerable web service endpoint that processes user input without bounds checking
  2. Crafting a malicious HTTP request with payload data exceeding the expected buffer size
  3. Overwriting the return address with a value pointing to attacker-controlled shellcode or existing code sequences
  4. Achieving arbitrary code execution with the privileges of the web service process

For detailed technical analysis, refer to the TW-CERT Security Advisory.

Detection Methods for CVE-2024-45694

Indicators of Compromise

  • Unexpected outbound connections from the router to unknown IP addresses, particularly on non-standard ports
  • Unusual CPU or memory utilization on the router device
  • Modified firmware configuration or unauthorized administrative accounts
  • Anomalous HTTP requests to the router's web management interface containing excessively long parameters
  • Evidence of crash dumps or service restarts in router logs indicating exploitation attempts

Detection Strategies

  • Monitor network traffic for suspicious HTTP requests targeting D-Link router management interfaces with unusually large payloads
  • Implement network-based intrusion detection rules to identify buffer overflow exploitation patterns
  • Deploy SentinelOne Singularity for network visibility to detect lateral movement from compromised IoT devices
  • Review router access logs for unauthorized access attempts or anomalous authentication patterns

Monitoring Recommendations

  • Enable verbose logging on affected D-Link routers if available, and forward logs to a centralized SIEM
  • Establish baseline network behavior for router devices and alert on deviations
  • Monitor for firmware integrity changes using periodic hash verification
  • Implement network segmentation monitoring to detect potential pivot attempts from compromised routers

How to Mitigate CVE-2024-45694

Immediate Actions Required

  • Check if your D-Link router model (DIR-X5460 or DIR-X4860) and firmware version are affected by reviewing the TW-CERT advisory
  • Restrict access to the router's web management interface to trusted internal networks only
  • Disable remote management features if not required for your deployment
  • Implement network segmentation to isolate IoT devices from critical network assets
  • Monitor for and apply firmware updates from D-Link as they become available

Patch Information

Organizations should monitor D-Link's official support channels for firmware updates addressing CVE-2024-45694. Given the critical severity of this vulnerability, firmware updates should be applied immediately upon release. Users are advised to regularly check for security advisories from both D-Link and TW-CERT for the latest patch information.

Workarounds

  • Disable the web management interface entirely if not required for day-to-day operations
  • Restrict web management access using firewall rules to allow only specific trusted IP addresses
  • Place the router behind an additional firewall or security appliance that can filter malicious HTTP requests
  • Consider replacing affected devices with models that have received security patches or are not vulnerable
  • Enable MAC address filtering as an additional access control layer for management interfaces
bash
# Example firewall rule to restrict web management access (adjust for your environment)
# Block external access to router management port 80/443
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypeBuffer Overflow

  • Vendor/TechDlink

  • SeverityCRITICAL

  • CVSS Score9.8

  • EPSS Probability2.58%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityHigh
  • CWE References
  • CWE-121
  • Technical References
  • TW-CERT Security Advisory

  • TW-CERT Notice on Vulnerability
  • Related CVEs
  • CVE-2026-7851: Dlink DI-8100 Buffer Overflow Vulnerability

  • CVE-2026-7854: D-Link DI-8100 Buffer Overflow Vulnerability

  • CVE-2026-7857: D-Link DI-8100 Buffer Overflow Vulnerability

  • CVE-2026-7068: D-Link DIR-825 Buffer Overflow Vulnerability
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the World’s Most Advanced Cybersecurity Platform

See how our intelligent, autonomous cybersecurity platform can protect your organization now and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English