CVE-2024-6045

D-Link router - Hidden Backdoor

Description

Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware.

Remediation

Solution:

  • Please update firmware of following models to 1.10.01 or later version： G403, G415, G416, M18, R03, R04, R12, R18 Please update firmware of following models to 1.10.02 or later version： E30, M30, M32, M60, R32 Please update firmware of following models to 1.20.01 or later version： E15, R15

Category

8.8
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.36%
Vendor Advisory dlink.com
Affected: D-Link G403
Affected: D-Link G415
Affected: D-Link G416
Affected: D-Link M18
Affected: D-Link R03
Affected: D-Link R04
Affected: D-Link R12
Affected: D-Link R18
Affected: D-Link E30
Affected: D-Link M30
Affected: D-Link M32
Affected: D-Link M60
Affected: D-Link R32
Affected: D-Link E15
Affected: D-Link R15
Published at:
Updated at:

References

Link Tags
https://www.twcert.org.tw/tw/cp-132-7879-da630-1.html third party advisory
https://www.twcert.org.tw/en/cp-139-7880-629f5-2.html third party advisory
https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398 vendor advisory

Frequently Asked Questions

What is the severity of CVE-2024-6045?
CVE-2024-6045 has been scored as a high severity vulnerability.
How to fix CVE-2024-6045?
To fix CVE-2024-6045: Please update firmware of following models to 1.10.01 or later version： G403, G415, G416, M18, R03, R04, R12, R18 Please update firmware of following models to 1.10.02 or later version： E30, M30, M32, M60, R32 Please update firmware of following models to 1.20.01 or later version： E15, R15
Is CVE-2024-6045 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-6045 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-6045?
CVE-2024-6045 affects D-Link G403, D-Link G415, D-Link G416, D-Link M18, D-Link R03, D-Link R04, D-Link R12, D-Link R18, D-Link E30, D-Link M30, D-Link M32, D-Link M60, D-Link R32, D-Link E15, D-Link R15.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.