16 D-Link routers with backdoor (CVE-2024-6045) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 20, 2024, 11:41:44 am
content: D-Link forgot to remove the debugging backdoor (CVE-2024-6045):- Taiwanese CERT:https://www.twcert.org.tw/en/cp-139-7880-629f5-2.html- D-Link's Security Announcement:https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398- affected routers: E15, E30, G403, G415, G416, M15, M18, M30, M32, M60, R03, R04, R12, R15, R18, R32

author: Karel
author_rank: Super Contributor
timestamp: June 20, 2024, 12:48:15 pm
content: Quote from: madires on June 20, 2024, 11:41:44 amHow do you know that they didn't do it by purpose, hoping that nobody would notice?Or do you simply assume that they are not evil?

author: madires
author_rank: Super Contributor
timestamp: June 20, 2024, 01:11:56 pm
content: Most likely we'll never know.However, based on their track record I tend towards 'forgot to remove".

author: Monkeh
author_rank: Super Contributor
timestamp: June 20, 2024, 01:18:19 pm
content: Quote from: Karel on June 20, 2024, 12:48:15 pmSimple incompetence explains the behaviour of these companies adequately on many levels, not merely their security failings.

author: Karel
author_rank: Super Contributor
timestamp: June 20, 2024, 01:44:05 pm
content: Quote from: Monkeh on June 20, 2024, 01:18:19 pmI'm not convinced. If it wasn't meant to stay, why did they try to hide it?Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor.Unauthenticated attackers on the local area network can force the device to enableTelnet service by accessing a specific URL and can log in by using the administratorcredentials obtained from analyzing the firmware.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 20, 2024, 09:09:20 pm
content: Nice.I really recommend installing OpenWrt on your router if your hardware is supported, anyway. If not having backdoors, the firmware of most routers are pumped full of telemetry and other crap.

author: DiTBho
author_rank: Super Contributor
timestamp: June 20, 2024, 09:53:17 pm
content: Quote from: SiliconWizard on June 20, 2024, 09:09:20 pmdirect experience: also fw based on uboot and redbootRecompiling these firmware by removing crappy parts... it was not an easy or immediate thingWho knows about Ubiquiti's and MikroTik's routers...

author: magic
author_rank: Super Contributor
timestamp: June 20, 2024, 10:17:10 pm
content: Maybe the company forgot, but the particular employee who added the backdoor actually wanted it

author: raymond1234
author_rank: Newbie
timestamp: June 25, 2024, 12:15:47 pm
content: Hello all, I am the researcher who reported this vulnerability and I don't think it is being added on purpose, here's why:It can only be triggered from LAN-side, WAN-side attacker can not directly gain access to intranet without a open redirection via social engineering users inside intranet.The hidden backdoor is a code port of older models, which is previously reported (by another security researcher) but not patched properly due to EOL (end of lifecycle)I have confirmed the patch after it had been released, the backdoor along with another path traversal vulnerability is removed, so panic not, it's a piece of legacy debug code existing there somehow.

author: Kjelt
author_rank: Super Contributor
timestamp: June 25, 2024, 06:10:12 pm
content: Asus also needed to update their routers lately for CVE-2024-3079 en CVE-2024-3080 issues.But older routers do not get a patch, I find that unacceptable.The least they could do is bring out a new firmware with a big warning on the login page that the router is unsecure.

author: madires
author_rank: Super Contributor
timestamp: June 25, 2024, 06:42:48 pm
content: Most manufacturers provide updates/patches only for two or three years before EOL-ing the router. They want you to buy a new device to make money. For long term support I'd recommend to get routers which are supported by OpenWrt.

author: Kjelt
author_rank: Super Contributor
timestamp: June 25, 2024, 07:25:54 pm
content: That is why EU legislation is so good. It forced Android phone makers to support security patches for several years.