CVE-2024-38438

The authentication mechanism in the device is vulnerable to a capture-replay attack (CWE-294), which involves intercepting valid authentication credentials transmitted over the network and then replaying them to gain access. The device does not implement appropriate protection mechanisms against reuse of intercepted sessions or authentication tokens. A remote attacker, without any privileges and without user interaction, can effectively impersonate an authenticated user.

An attacker can gain unauthorized access to the device's administrative panel, leading to complete control over the DSL router — including changes to network configuration, interception of network traffic, and potential compromise of system confidentiality, integrity, and availability.

Security patches available from the manufacturer should be applied in accordance with the references. It is also recommended to restrict access to the device management interface exclusively to trusted IP addresses and to avoid exposing the administrative panel directly to the public Internet.

D-Link DSL-225 and D-Link DSL-225 Firmware — specific versions indicated in the manufacturer's references