CVE-2024-6045: D-Link Router Auth Bypass Vulnerability

CVE-2024-6045 Overview

CVE-2024-6045 is a critical firmware vulnerability affecting certain models of D-Link wireless routers. The vulnerability stems from an undisclosed factory testing backdoor that allows unauthenticated attackers on the local area network to force the device to enable Telnet service by accessing a specific URL. Once Telnet is enabled, attackers can log in using administrator credentials obtained through firmware analysis, effectively gaining full administrative control over the affected device.

Critical Impact

Unauthenticated attackers on the local network can gain full administrative access to affected D-Link routers through a hidden factory testing backdoor, enabling complete device compromise including traffic interception, configuration modification, and lateral network movement.

Affected Products

• D-Link wireless routers (specific models detailed in D-Link Security Advisory SAP10398)

Discovery Timeline

• 2024-06-17 - CVE-2024-6045 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6045

Vulnerability Analysis

This vulnerability is classified under CWE-798 (Use of Hard-coded Credentials), a critical security weakness that represents one of the most severe firmware vulnerability categories. The flaw exists because D-Link's factory testing functionality was inadvertently left accessible in production firmware, creating a persistent backdoor that bypasses normal authentication mechanisms.

The attack requires adjacent network access, meaning the attacker must be on the same local network segment as the vulnerable router. However, once this condition is met, the exploitation requires no authentication and no user interaction, making it highly exploitable in enterprise and home network environments where attackers have gained initial network access.

Root Cause

The root cause of CVE-2024-6045 is the presence of undisclosed factory testing functionality that was not properly disabled or removed before production deployment. This testing backdoor includes:

1. A hidden URL endpoint that, when accessed, forcefully enables the Telnet service on the router
2. Hard-coded administrator credentials embedded in the firmware that can be extracted through reverse engineering

This represents a fundamental violation of secure development practices, where debug and testing interfaces should be completely removed or cryptographically protected before release.

Attack Vector

The attack follows a straightforward exploitation chain:

1. Network Positioning: Attacker gains access to the local area network (LAN) where the vulnerable D-Link router operates
2. Service Activation: Attacker accesses the specific hidden URL to force-enable Telnet service on the router
3. Credential Extraction: Attacker analyzes the router firmware (available from D-Link's website or extracted from the device) to obtain hardcoded administrator credentials
4. Administrative Access: Attacker connects to the newly enabled Telnet service using the extracted credentials
5. Full Compromise: With administrative access, the attacker can modify router configuration, intercept traffic, deploy persistent backdoors, or pivot to other network devices

The vulnerability requires adjacent network access (AV:A), low attack complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), resulting in complete compromise of confidentiality, integrity, and availability.

Detection Methods for CVE-2024-6045

Indicators of Compromise

• Unexpected Telnet service (port 23) activation on D-Link routers that should not have this service enabled
• Telnet login attempts using default or extracted administrator credentials
• Unusual HTTP requests to non-standard URL paths on the router's web interface
• Network traffic to/from router management interfaces from unauthorized internal hosts
• Configuration changes to router settings without authorized administrator activity

Detection Strategies

• Monitor network traffic for Telnet connections (TCP port 23) to router management interfaces
• Implement network access control lists (ACLs) to restrict management interface access to authorized hosts only
• Deploy network-based intrusion detection systems (IDS) to alert on Telnet service enumeration or connection attempts to network infrastructure
• Regularly audit router configurations for unauthorized changes or unexpected service enablement
• Use endpoint detection and response (EDR) solutions to identify hosts making suspicious connections to network infrastructure

Monitoring Recommendations

• Enable logging on all network infrastructure devices and forward logs to a centralized SIEM
• Create alerts for any Telnet service state changes on managed network devices
• Monitor for firmware analysis tools or suspicious firmware download activity on network endpoints
• Implement network segmentation to limit lateral movement from potentially compromised devices
• Conduct regular vulnerability scans of network infrastructure to identify affected devices

How to Mitigate CVE-2024-6045

Immediate Actions Required

• Identify all D-Link wireless routers in your environment and check against the affected models list in the D-Link Security Advisory SAP10398
• Apply firmware updates immediately for all affected devices
• Restrict network access to router management interfaces using VLANs and access control lists
• Disable Telnet service if currently enabled and monitor for unauthorized re-enablement
• Consider replacing end-of-life devices that will not receive security patches

Patch Information

D-Link has released security updates to address this vulnerability. Affected users should consult the D-Link Security Advisory SAP10398 for specific firmware versions and download links for their router model. Additional details are available from TW-CERT in their advisories CP-139-7880 and CP-132-7879.

Workarounds

• Implement strict network segmentation to isolate management interfaces from general user traffic
• Deploy firewall rules to block all Telnet (TCP/23) traffic to and from affected routers
• Use out-of-band management networks for router administration where possible
• Implement 802.1X network access control to limit which devices can connect to the LAN segment containing vulnerable routers
• Monitor and alert on any attempts to access known factory testing URL patterns

# Example firewall rule to block Telnet access to router (iptables)
iptables -A FORWARD -p tcp --dport 23 -d <router_ip> -j DROP
iptables -A OUTPUT -p tcp --dport 23 -d <router_ip> -j DROP

# Block Telnet from router to prevent outbound connections
iptables -A FORWARD -p tcp --sport 23 -s <router_ip> -j DROP