CVE-2024-41622
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on D-Link DIR-846W routers via the tomography_ping_address parameter in the HNAP1 interface. Attackers can gain complete control of affected devices. All users of DIR-846W A1 routers with firmware version 100A43 are affected.
💻 Affected Systems
- D-Link DIR-846W A1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to install persistent malware, pivot to internal networks, intercept all network traffic, or brick the device.
Likely Case
Attackers install cryptocurrency miners, create botnet nodes, or intercept credentials from network traffic.
If Mitigated
Limited impact if device is behind firewall with HNAP1 interface blocked from internet access.
🎯 Exploit Status
Public PoC available on GitHub. Simple HTTP POST request with command injection payload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest firmware
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Restart Required: Yes
Instructions:
1. Visit D-Link support site. 2. Download latest firmware for DIR-846W A1. 3. Log into router admin interface. 4. Navigate to Firmware Update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Block HNAP1 Interface
linuxBlock access to HNAP1 interface via firewall rules
iptables -A INPUT -p tcp --dport 80 -m string --string "POST /HNAP1/" --algo bm -j DROP
Disable Remote Management
allTurn off remote administration in router settings
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Replace with patched or different router model
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under Status > FirmwareCheck Version:
curl -s http://router-ip/HNAP1/ | grep -i firmwareVerify Fix Applied:
Verify firmware version is newer than 100A43 and test with known PoC📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /HNAP1/ with unusual parameters
- Command execution patterns in system logs
Network Indicators:
- HTTP traffic to router port 80 with tomography_ping_address parameter containing shell metacharacters
SIEM Query:
source="router_logs" AND (url="/HNAP1/" AND method="POST" AND (param="tomography_ping_address" AND value MATCH "[;&|`]"))