Access Control Issue in D-Link Router Allows Unauthenticated Network Configuration
CVE-2024-57676

6.5MEDIUM

Key Information:

Vendor

D-Link
Status
D-Link 816A2 Firmware
Vendor
CVE Published:
16 January 2025

What is CVE-2024-57676?

An access control flaw in D-Link's 816A2 firmware allows unauthenticated attackers to change the WLAN settings for both 2.4G and 5G networks. By sending a specially crafted POST request, attackers can manipulate crucial network configurations without needing any form of authentication. This vulnerability could potentially expose sensitive network environments to unauthorized access and attacks, making it essential for users to ensure their firmware is up to date and to implement additional security measures.

References

https://www.dlink.com/en/security-bulletin/
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/U...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.