CVE-2024-41611

The vulnerability results from the presence of hardcoded credentials (CWE-798) embedded directly in the device firmware. The Telnet service available over the network accepts these static login credentials, which the user cannot change or remove in a standard way. An attacker who knows these credentials can establish a Telnet session from anywhere on the network and gain interactive access to the device's system shell.

An attacker gains full, unauthorized access to the device with the ability to execute arbitrary commands — which can result in router takeover, modification of network configuration, interception of network traffic, or use of the device as a pivot point for further attacks (lateral movement).

Apply patches available from the manufacturer in accordance with the references (https://www.dlink.com/en/security-bulletin/). If a patch is not available, it is recommended to block access to the Telnet service at the firewall level and restrict access to the management interface solely to trusted IP addresses. Consider replacing the device if the manufacturer does not provide updates.

D-Link DIR-860L REVA with firmware PATCH 1.10.B04