In a critical security disclosure, it has been revealed that thousands of end-of-life (EOL) D-Link DSL-6740C routers are vulnerable to password change attacks.
The vulnerability tracked as CVE-2024-11068 has been rated as critical by the TWCERT/CC, with an alarming CVSS score of 9.8.
The affected routers, no longer supported by D-Link as of January 15, 2024, are at high risk of unauthorized access and potential misuse.
Free Ultimate Continuous Security Monitoring Guide - Download Here (PDF)
The vulnerability allows attackers to gain unauthorized access to the router’s configuration, enabling them to change the device’s administrator password remotely.
Due to improper handling of privileged APIs in the router’s firmware, this can be accomplished without any prior authentication.
Once exploited, attackers could take full control of the affected routers, compromising connected networks’ integrity, confidentiality, and availability.
Affected Models
The affected routers are DSL-6740C, a model not available in the US market:
| Model | Region | Hardware Revision | End of Support | Legacy Website | Last Updated |
| DSL-6740C | Non-US | All Series H/W Revisions | 01/15/2024 | No | 11/12/2024 |
Since the DSL-6740C routers have reached their End of Life (EOL) and End of Support (EOS), D-Link urges users to retire them and replace them with newer models.
No further firmware updates or customer support will be provided for these routers, leaving them vulnerable to future exploits.
D-Link recommends applying the latest firmware, changing default passwords, and ensuring Wi-Fi encryption is enabled for those who continue to use these devices.
The disclosure of CVE-2024-11068 reminds consumers to replace outdated and unsupported hardware.
Continued use of these routers could expose users to significant security risks, including unauthorized access and network compromise.
Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!
Cybersecurity researchers are raising alarms about Cable, a potent open-source post-exploitation toolkit designed to exploit Active…
A critical security vulnerability has been discovered in the Langflow AI Builder, a popular tool…
A hacker operating under the alias “Satanic” has claimed responsibility for a massive data breach…
A critical vulnerability has been discovered in TP-Link’s Smart Hub, potentially exposing users’ Wi-Fi credentials…
Southeast Asian Advanced Persistent Threat (APT) group OceanLotus, also known as APT32, has been identified…
AkiraBot, identified by SentinelLABS, represents a sophisticated spam bot framework that targets website chats and…