CVE-2024-13106
📋 TL;DR
This vulnerability in D-Link DIR-816 routers allows unauthorized access to the IP QoS configuration handler due to improper access controls. Attackers can remotely exploit this to modify Quality of Service settings without authentication. Only D-Link DIR-816 A2 routers with specific firmware versions are affected.
💻 Affected Systems
- D-Link DIR-816 A2
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could reconfigure network traffic prioritization, potentially enabling denial of service or traffic manipulation attacks against the local network.
Likely Case
Unauthorized modification of QoS settings leading to degraded network performance or disruption of specific services.
If Mitigated
With proper network segmentation and firewall rules, impact is limited to the router's configuration interface only.
🎯 Exploit Status
Exploit details are publicly available on GitHub; attack requires network access to router web interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.dlink.com/
Restart Required: No
Instructions:
Check D-Link website for firmware updates; if unavailable, consider router replacement
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router web interface
Network segmentation
allIsolate router management interface from untrusted networks
🧯 If You Can't Patch
- Replace affected router with supported model
- Implement strict firewall rules blocking access to router web interface from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at 192.168.0.1 or 192.168.1.1Check Version:
Check router web interface under 'Status' or 'System' sectionVerify Fix Applied:
Verify firmware version is updated beyond vulnerable version📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to /goform/form2IPQoSTcAdd
- Unexpected QoS configuration changes
Network Indicators:
- HTTP requests to router IP on port 80 targeting form2IPQoSTcAdd endpoint
SIEM Query:
http.url:*form2IPQoSTcAdd AND http.method:POST AND NOT user_agent:expected_browser🔗 References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2IPQoSTcAdd.md
- https://vuldb.com/?ctiid.289922
- https://vuldb.com/?id.289922
- https://vuldb.com/?submit.472086
- https://www.dlink.com/
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2IPQoSTcAdd.md
