CVE-2024-29385
📋 TL;DR
CVE-2024-29385 is an unauthenticated remote code execution vulnerability in D-Link DIR-845L routers. Attackers can exploit the soapcgi_main function in the cgibin binary to execute arbitrary code without credentials. This affects all users of DIR-845L routers running vulnerable firmware versions.
💻 Affected Systems
- D-Link DIR-845L Wireless Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to install persistent malware, intercept all network traffic, pivot to internal devices, and use the router as part of a botnet.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and deployment of malware to connected devices.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and regular firmware updates.
🎯 Exploit Status
Public exploit details available in GitHub repository. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check D-Link advisory for latest patched version
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to System > Firmware Update. 3. Download latest firmware from D-Link support site. 4. Upload and apply firmware update. 5. Reboot router after update completes.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Network Segmentation
allIsolate router management interface to trusted network
🧯 If You Can't Patch
- Replace vulnerable router with supported model
- Implement strict firewall rules blocking all WAN access to router management ports (80, 443, 8080)
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface: System > Firmware Update > Current Firmware VersionCheck Version:
curl -s http://router-ip/version.cgi | grep FirmwareVerify Fix Applied:
Verify firmware version is newer than v1.01KRb03 and test SOAP endpoints are no longer accessible📡 Detection & Monitoring
Log Indicators:
- Unusual SOAP requests to /soap.cgi
- Multiple failed authentication attempts followed by successful SOAP access
- Unexpected process execution in router logs
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Traffic patterns indicating command and control communication
SIEM Query:
source="router.log" AND (uri="/soap.cgi" OR uri="/cgibin") AND (method="POST" OR method="GET")