Description:

CVE-2024-41611 is a critical vulnerability in D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04 that allows remote attackers to log in to the Telnet service and execute arbitrary commands due to hardcoded credentials. The CVSS score of 9.8 indicates the severity of this vulnerability, while the SVRS of 46 highlights the urgency of addressing it.

Key Insights:

• Remote Access: The vulnerability allows attackers to gain remote access to the affected device, potentially compromising sensitive data and disrupting operations.
• Arbitrary Command Execution: Attackers can execute arbitrary commands on the device, giving them complete control over its functionality.
• In the Wild: The vulnerability is actively exploited by hackers, making it a high-priority threat.

Mitigation Strategies:

• Update Firmware: Install the latest firmware update from D-Link to patch the vulnerability.
• Disable Telnet: If possible, disable the Telnet service on the device to prevent attackers from exploiting the vulnerability.
• Use Strong Passwords: Change the default password for the Telnet service to a strong and unique one.
• Monitor Network Traffic: Implement network monitoring tools to detect and block suspicious activity related to the vulnerability.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.