CVE-2024-45697

The router's firmware contains a hidden mechanism that launches the telnet service when a connection on the WAN port is detected. This service uses hardcoded credentials that cannot be changed through the standard management interface. Remote attackers without any privileges can exploit these credentials to log in over the network and gain access to the device's system shell. This occurs without any user interaction and requires no special knowledge of device configuration.

Attacker gains full unauthorized access to the router's operating system, enabling execution of arbitrary OS commands — including modification of network configuration, interception of network traffic, installation of malicious software, and potential use of the device as an entry point to the internal network.

Apply patches available from the manufacturer according to provided references. Until patches are deployed, it is recommended to restrict access to the router's WAN port and monitor unauthorized telnet connections. If the manufacturer has not released updates, consider device replacement or network isolation.

D-Link DIR-X4860 — specific firmware versions indicated in manufacturer references (TWCERT)