In a critical security disclosure, it has been revealed that thousands of end-of-life (EOL) D-Link DSL-6740C routers are vulnerable to password change attacks.
The vulnerability tracked as CVE-2024-11068 has been rated as critical by the TWCERT/CC, with an alarming CVSS score of 9.8.
The affected routers, no longer supported by D-Link as of January 15, 2024, are at high risk of unauthorized access and potential misuse.
Free Ultimate Continuous Security Monitoring Guide - Download Here (PDF)
The vulnerability allows attackers to gain unauthorized access to the router’s configuration, enabling them to change the device’s administrator password remotely.
Due to improper handling of privileged APIs in the router’s firmware, this can be accomplished without any prior authentication.
Once exploited, attackers could take full control of the affected routers, compromising connected networks’ integrity, confidentiality, and availability.
Affected Models
The affected routers are DSL-6740C, a model not available in the US market:
| Model | Region | Hardware Revision | End of Support | Legacy Website | Last Updated |
| DSL-6740C | Non-US | All Series H/W Revisions | 01/15/2024 | No | 11/12/2024 |
Since the DSL-6740C routers have reached their End of Life (EOL) and End of Support (EOS), D-Link urges users to retire them and replace them with newer models.
No further firmware updates or customer support will be provided for these routers, leaving them vulnerable to future exploits.
D-Link recommends applying the latest firmware, changing default passwords, and ensuring Wi-Fi encryption is enabled for those who continue to use these devices.
The disclosure of CVE-2024-11068 reminds consumers to replace outdated and unsupported hardware.
Continued use of these routers could expose users to significant security risks, including unauthorized access and network compromise.
Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…