CVE-2024-38437

The vulnerability classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and CWE-306 (Missing Authentication for Critical Function) allows an attacker to access protected device functions without providing correct authentication credentials. This is possible by exploiting an alternative path or communication channel that is not covered by standard identity verification. The attack can be conducted remotely over the network, without user interaction, and without requiring any privileges.

An attacker can gain unauthorized access to the device with full privileges, which may result in taking control of the router/modem, modifying its configuration, intercepting network traffic, or enabling further lateral movement within the network.

Patches available from the manufacturer should be applied according to references. Additionally, it is recommended to restrict access to the device management interface only to trusted IP addresses and to isolate the device from unauthorized network segments until updates are deployed.

D-Link DSL-225 devices and their firmware — specific versions indicated in manufacturer references