CVE-2020-9275
📋 TL;DR
This vulnerability allows remote, unauthenticated attackers to exfiltrate administrative credentials from D-Link DSL-2640B routers via a UDP service on port 65002. Attackers can gain full administrative access to affected routers. Only D-Link DSL-2640B B2 EU_4.01B devices are affected.
💻 Affected Systems
- D-Link DSL-2640B
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with administrative access, allowing attackers to reconfigure network settings, intercept traffic, install malware, or use as pivot point for internal attacks.
Likely Case
Attackers steal administrative credentials and gain full control of the router to monitor network traffic, change DNS settings, or disable security features.
If Mitigated
No impact if router is not internet-facing and network segmentation prevents access to port 65002.
🎯 Exploit Status
Simple UDP packet to port 65002 triggers credential disclosure. No authentication required. Public exploit scripts available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check D-Link security bulletin for latest firmware
Vendor Advisory: https://www.dlink.com/en/security-bulletin
Restart Required: Yes
Instructions:
1. Visit D-Link support site. 2. Download latest firmware for DSL-2640B. 3. Log into router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Router will restart automatically.
🔧 Temporary Workarounds
Block UDP port 65002
linuxBlock access to the vulnerable cfm service port using firewall rules
iptables -A INPUT -p udp --dport 65002 -j DROP
iptables -A FORWARD -p udp --dport 65002 -j DROP
Disable remote administration
allTurn off remote management/WAN access to router admin interface
🧯 If You Can't Patch
- Replace affected router with supported model
- Place router behind firewall that blocks all inbound UDP traffic to port 65002
🔍 How to Verify
Check if Vulnerable:
Send UDP packet to port 65002: echo -n 'get' | nc -u <router_ip> 65002. If credentials are returned, device is vulnerable.Check Version:
Log into router web interface and check firmware version in System Status or similar section.Verify Fix Applied:
After patching, repeat the check command. No credentials should be returned. Also verify firmware version is updated.📡 Detection & Monitoring
Log Indicators:
- UDP connections to port 65002 in router logs
- Multiple failed login attempts after credential exposure
- Unusual configuration changes
Network Indicators:
- UDP traffic to port 65002 from external sources
- Sudden DNS changes or proxy settings modifications
SIEM Query:
source_port=65002 AND protocol=UDP OR (event_type="authentication" AND result="failure" AND source_ip=router_ip)🔗 References
- https://raelize.com/advisories/CVE-2020-9275_D-Link-DSL-2640B_Remote-Credentials-Exfiltration_v1.0.txt
- https://raelize.com/posts/d-link-dsl-2640b-security-advisories/
- https://www.dlink.com/en/security-bulletin
- https://raelize.com/advisories/CVE-2020-9275_D-Link-DSL-2640B_Remote-Credentials-Exfiltration_v1.0.txt
- https://raelize.com/posts/d-link-dsl-2640b-security-advisories/
- https://www.dlink.com/en/security-bulletin
