by Kastro
Paper/Archive/CVE-2024-11068

CVE-2024-11068

D-Link DSL6740C — D-Link DSL6740C - Incorrect Use of Privileged APIs

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 67.3.673 × 2013.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user’s password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user’s account.

Affected

ProductAffectedFixed inSource
DSL6740Call versions–CNA
dsl6740c_firmwareall versions–CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8227-f3f3b-1.htmlwriteuptwcert.org.tw/en/cp-139-8234-0514c-2.htmlrefbleepingcomputer.com/news/security/d-link-wont-fix-critical-bug-in-60-000-exposed-eol-modems