CVE-2024-33110
📋 TL;DR
The D-Link DIR-845L router contains a permission bypass vulnerability in the getcfg.php component that allows attackers to access sensitive configuration data without authentication. This affects all versions up to v1.01KRb03. Attackers can exploit this to obtain router credentials and potentially gain full control of the device.
💻 Affected Systems
- D-Link DIR-845L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise leading to credential theft, network traffic interception, malware deployment, and use as pivot point into internal networks.
Likely Case
Router credential theft enabling administrative access, configuration changes, and potential firmware modification.
If Mitigated
Limited impact if router is behind firewall with restricted WAN access and strong internal segmentation.
🎯 Exploit Status
Public proof-of-concept demonstrates simple HTTP request exploitation. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Check D-Link website for firmware updates. If no update exists, consider replacing the router.
🔧 Temporary Workarounds
Disable WAN Management
allPrevent external access to router management interface
Access router admin panel -> Security -> Remote Management -> Disable
Block getcfg.php Access
linuxUse firewall rules to block access to vulnerable component
iptables -A INPUT -p tcp --dport 80 -m string --string "getcfg.php" --algo bm -j DROP
🧯 If You Can't Patch
- Replace router with supported model
- Isolate router in separate VLAN with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[router-ip]/getcfg.php and check if configuration data is returned without authenticationCheck Version:
Check router web interface or use nmap -sV -p80 [router-ip] to identify versionVerify Fix Applied:
Test the same request after applying workarounds - should return error or no sensitive data📡 Detection & Monitoring
Log Indicators:
- HTTP requests to getcfg.php from unusual IPs
- Multiple failed login attempts followed by getcfg.php access
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns suggesting configuration export
SIEM Query:
source="router_logs" AND uri="/getcfg.php" AND NOT src_ip IN [admin_ips]