CVE-2018-6210
📋 TL;DR
D-Link DIR-620 routers with Rostelekom firmware version 1.0.37 contain a hardcoded 'rostel' account that allows remote attackers to gain administrative access via TELNET. This affects all devices running this specific firmware variant, making them vulnerable to complete compromise. Attackers can exploit this without any authentication.
💻 Affected Systems
- D-Link DIR-620
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and disable security controls.
Likely Case
Attackers gain administrative access to modify router settings, redirect DNS, capture credentials, and use the device as a foothold for further attacks.
If Mitigated
If TELNET is disabled and firmware is updated, risk is significantly reduced though the backdoor remains in the firmware.
🎯 Exploit Status
Exploitation is trivial: telnet to router IP and login with hardcoded credentials 'rostel' account. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions remove the hardcoded account
Vendor Advisory: https://support.dlink.com/
Restart Required: Yes
Instructions:
1. Download latest firmware from D-Link support site. 2. Log into router web interface. 3. Navigate to System Tools > Firmware Upgrade. 4. Upload new firmware file. 5. Wait for reboot (do not interrupt power).
🔧 Temporary Workarounds
Disable TELNET service
allPrevents remote exploitation by disabling the vulnerable TELNET service
telnet_enable=0
service telnet stop
Block TELNET at firewall
linuxBlock TELNET port 23 at network perimeter
iptables -A INPUT -p tcp --dport 23 -j DROP
🧯 If You Can't Patch
- Replace affected devices with non-vulnerable models
- Isolate routers in separate VLAN with strict access controls
🔍 How to Verify
Check if Vulnerable:
Attempt TELNET connection to router on port 23 and try to login with 'rostel' accountCheck Version:
Check router web interface under Status > Device Info or run 'cat /proc/version' via SSH if availableVerify Fix Applied:
After firmware update, verify TELNET connection fails or requires proper authentication📡 Detection & Monitoring
Log Indicators:
- Failed/successful TELNET authentication attempts
- Login attempts with 'rostel' username
Network Indicators:
- TELNET connections to router on port 23
- Unusual outbound traffic from router
SIEM Query:
source="router.log" AND (event="telnet_login" OR username="rostel")