CVE-2024-44589
📋 TL;DR
A stack overflow vulnerability in the HNAP service login function of D-Link DCS-960L IP cameras allows remote attackers to execute arbitrary code by sending specially crafted requests. This affects DCS-960L devices running firmware version 1.09, potentially giving attackers full control of the camera.
💻 Affected Systems
- D-Link DCS-960L
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent remote access, camera control, network pivoting, and data exfiltration.
Likely Case
Remote code execution leading to camera hijacking, surveillance disruption, and credential theft.
If Mitigated
Limited impact if device is isolated behind firewall with restricted network access.
🎯 Exploit Status
Proof-of-concept available in GitHub repository; exploit requires sending crafted HTTP request to HNAP endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.dlink.com/en/security-bulletin/
Restart Required: No
Instructions:
1. Check D-Link security bulletin for firmware updates. 2. If update available, download from official D-Link support site. 3. Upload firmware via web interface. 4. Reboot device after update.
🔧 Temporary Workarounds
Network Isolation
linuxBlock external access to camera management interface
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable HNAP Service
allTurn off HNAP protocol if not required
🧯 If You Can't Patch
- Isolate camera on separate VLAN with strict firewall rules
- Disable remote management and only allow local network access
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface: Settings > System > FirmwareCheck Version:
curl -s http://[CAMERA_IP]/get_status.cgi | grep firmware_versionVerify Fix Applied:
Verify firmware version is newer than 1.09📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts
- Unusual HNAP protocol requests
- Large payloads to login endpoint
Network Indicators:
- HTTP POST requests to /HNAP1/ with oversized parameters
- Traffic to port 80 with abnormal payload sizes
SIEM Query:
source="camera.log" AND ("HNAP1" OR "login") AND bytes > 10000