CVE-2024-37630
📋 TL;DR
D-Link DIR-605L routers contain a hardcoded root password in the /etc/passwd file, allowing attackers to gain full administrative control. This affects all users of DIR-605L firmware version 2.13B01. Attackers can exploit this without any authentication.
💻 Affected Systems
- D-Link DIR-605L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, and disable security features.
Likely Case
Attackers gain root access to modify router settings, redirect DNS, capture credentials, and use the device as a foothold for further attacks.
If Mitigated
If isolated from internet and with strict network segmentation, impact limited to local network compromise.
🎯 Exploit Status
Exploitation requires only SSH/Telnet access to the router with the hardcoded credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Check D-Link website for firmware updates. If none exist, replace device.
🔧 Temporary Workarounds
Change root password
linuxManually change the root password via SSH/Telnet if accessible
passwd root
Disable remote administration
allTurn off remote management in router settings
🧯 If You Can't Patch
- Immediately isolate affected routers from internet and critical networks
- Replace vulnerable devices with supported models
🔍 How to Verify
Check if Vulnerable:
SSH/Telnet to router and attempt login with hardcoded credentials found in public reportsCheck Version:
Check router web interface or run 'cat /etc/version' via SSHVerify Fix Applied:
Verify root password has been changed and cannot be accessed with known hardcoded credentials📡 Detection & Monitoring
Log Indicators:
- Failed SSH/Telnet login attempts followed by successful root login
- Unusual configuration changes
Network Indicators:
- Unexpected SSH/Telnet connections to router
- DNS changes or unusual outbound traffic
SIEM Query:
source="router_logs" (event="authentication success" AND user="root")