CVE-2024-41616

D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service

High · published August 6, 2024

CVSS v3.1
8.8
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

⚡ The D-Link DIR-300 REVA has hardcoded Telnet credentials that could let anyone waltz in effortlessly — no super skills required! 🔥 Think of it like leaving a spare key under the welcome mat; it's extremely convenient for guests, but also an open invitation for intruders. In this case, the hardcoded credentials are the spare key just waiting to be discovered by anyone who knows where to look. An attacker could easily take control of your device, change settings, or even reroute traffic, leading to potential data breaches or network disruptions. This vulnerability could spell disaster for your home network security if left unaddressed!

Put simply

Think of it like leaving a spare key under the welcome mat; it's extremely convenient for guests, but also an open invitation for intruders. In this case, the hardcoded credentials are the spare key just waiting to be discovered by anyone who knows where to look. The vulnerability exists because the D-Link DIR-300 REVA firmware v1.06B05_WW contains hardcoded Telnet credentials, which can be exploited by attackers to gain unauthorized access to the device without needing to crack any passwords.

What to do

An attacker could easily take control of your device, change settings, or even reroute traffic, leading to potential data breaches or network disruptions. This vulnerability could spell disaster for your home network security if left unaddressed! Immediately change any default credentials if you’re using this model, and consider disabling the Telnet service altogether to reduce exposure. Check for firmware updates from D-Link and apply them as soon as they’re available. You've got this! With a little effort, you can ensure your network stays safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00763 · 54.9th percentile
Published
2024-08-06T00:00Z
EPSS history
Timeline
  • 06 AUG 00:00Z
    D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service
    cvelistv5