Critical severity · published Nov 11, 2024
CVE-2024-11068
D-Link DSL6740C - Incorrect Use of Privileged APIs
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user’s account.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
DSL6740C · D-Link
0 · source: vendor
DF
Dsl6740c Firmware · Dlink
0 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11068
Third Party Advisory
https://www.twcert.org.tw/en/cp-139-8234-0514c-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-8227-f3f3b-1.html
www.bleepingcomputer.com
https://www.bleepingcomputer.com/news/security/d-link-wont-fix-critical-bug-in-60-000-exposed-eol-modems/
More from DSL6740C
7.5
CVE-2024-11067
D-Link DSL6740C - Arbitrary File Reading through Path Traversal
7.2
CVE-2024-11066
D-Link DSL6740C - OS Command Injection
7.2
CVE-2024-11065
D-Link DSL6740C - OS Command Injection
7.2
CVE-2024-11064
D-Link DSL6740C - OS Command Injection
7.2
CVE-2024-11063
D-Link DSL6740C - OS Command Injection