CVE-2024-45697: D-Link DIR-X4860 Firmware RCE Vulnerability

CVE-2024-45697 Overview

CVE-2024-45697 is a critical firmware vulnerability affecting certain D-Link wireless routers that exposes a hidden telnet service backdoor. When the WAN port is connected, the telnet service is automatically enabled without user knowledge or consent. This hidden functionality, combined with hard-coded credentials embedded in the firmware, allows unauthorized remote attackers to log in and execute arbitrary OS commands on the affected device.

Critical Impact

Unauthorized remote attackers can gain complete control over affected D-Link routers using hard-coded credentials, enabling full OS command execution, network compromise, and potential lateral movement to connected devices.

Affected Products

• D-Link DIR-X4860 Firmware version 1.00
• D-Link DIR-X4860 Firmware version 1.04
• D-Link DIR-X4860 Hardware revision A1

Discovery Timeline

• 2024-09-16 - CVE-2024-45697 published to NVD
• 2024-09-19 - Last updated in NVD database

Technical Details for CVE-2024-45697

Vulnerability Analysis

This vulnerability represents a severe security flaw classified under CWE-912 (Hidden Functionality). The D-Link DIR-X4860 wireless router contains undocumented telnet service functionality that activates automatically when the WAN port detects an active connection. This behavior is not documented in user manuals and cannot be disabled through normal configuration interfaces.

The critical nature of this vulnerability stems from the combination of two dangerous conditions: the automatic exposure of a remote access service and the presence of hard-coded authentication credentials within the firmware. This effectively creates a backdoor that bypasses all normal authentication mechanisms and security controls configured by device administrators.

Once connected to the telnet service, attackers can authenticate using the embedded credentials and execute arbitrary operating system commands with root-level privileges. This grants complete control over the router's functionality, including the ability to modify routing tables, intercept network traffic, pivot to internal network hosts, or use the device as part of a botnet infrastructure.

Root Cause

The root cause of CVE-2024-45697 is the presence of hidden functionality (CWE-912) intentionally embedded in the D-Link DIR-X4860 firmware. This includes:

1. Undocumented Telnet Activation: The firmware contains logic that automatically enables the telnet daemon when WAN connectivity is established, bypassing user configuration preferences.

2. Hard-Coded Credentials: Authentication credentials are statically embedded within the firmware binary, making them identical across all devices running the same firmware version and impossible to change through normal means.

3. No User Notification: The activation of this service occurs silently without any indication to the device administrator, violating the principle of least surprise.

Attack Vector

The attack vector for CVE-2024-45697 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying D-Link DIR-X4860 routers exposed to the internet with active WAN connections
2. Connecting to the telnet service on the standard port (TCP 23)
3. Authenticating using the hard-coded credentials embedded in the firmware
4. Executing arbitrary OS commands to compromise the device

The vulnerability is particularly dangerous because it is automatically exposed whenever the router is connected to the internet, which is the primary use case for these devices. No specific configuration or user action is required to make the device vulnerable.

Detection Methods for CVE-2024-45697

Indicators of Compromise

• Unexpected telnet connections (TCP port 23) to or from the router
• Unusual outbound network traffic from the router to unknown external IP addresses
• Modified router configurations or DNS settings that were not authorized
• Presence of unauthorized user accounts or processes on the router
• Network traffic patterns consistent with command-and-control communication

Detection Strategies

• Monitor network traffic for telnet (TCP/23) connections to edge routers, especially from external IP addresses
• Implement network intrusion detection rules to alert on telnet connections to D-Link devices
• Perform regular firmware version audits to identify vulnerable DIR-X4860 devices running versions 1.00 or 1.04
• Deploy network segmentation to isolate IoT and networking devices from critical infrastructure

Monitoring Recommendations

• Enable logging on upstream firewalls to capture all telnet connection attempts
• Configure SIEM alerts for any telnet traffic involving router management interfaces
• Conduct periodic vulnerability scans to detect devices with exposed telnet services
• Review router logs for unusual authentication attempts or command execution

How to Mitigate CVE-2024-45697

Immediate Actions Required

• Block inbound telnet (TCP port 23) connections at the perimeter firewall to prevent external exploitation
• Identify all D-Link DIR-X4860 routers in your environment and assess their exposure
• Consider temporarily disconnecting affected routers from the WAN until a patch is available
• Implement network access control lists (ACLs) to restrict management access to trusted networks only
• Monitor for firmware updates from D-Link that address this vulnerability

Patch Information

As of the last NVD update on September 19, 2024, D-Link has not released an official patch addressing CVE-2024-45697. Administrators should monitor D-Link security advisories and the TWCert Security Advisory for updates regarding remediation options.

Given the critical nature of this vulnerability and the use of hard-coded credentials, a firmware update from D-Link is required to fully remediate the issue. Standard password changes through the web interface will not mitigate this vulnerability.

Workarounds

• Deploy firewall rules to block all inbound telnet traffic (TCP/23) to affected routers
• Place vulnerable routers behind a secondary firewall or VPN appliance to limit direct internet exposure
• Consider replacing affected devices with routers from vendors that do not embed hidden functionality or hard-coded credentials
• If continued use is required, implement strict network segmentation to limit potential lateral movement in case of compromise

# Example firewall rule to block telnet access (iptables)
iptables -A INPUT -p tcp --dport 23 -j DROP
iptables -A OUTPUT -p tcp --sport 23 -j DROP

# Example ACL for Cisco devices to block telnet to router subnet
access-list 100 deny tcp any 192.168.1.0 0.0.0.255 eq 23
access-list 100 permit ip any any