Description
Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware.
Scores
CVSS v3
8.8
EPSS
0.0762
EPSS Percentile
91.9%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-798
CWE-912
Status
published
Products (15)
D-Link/E15
earlier - 1.20.01
D-Link/E30
earlier - 1.10.02
D-Link/G403
earlier - 1.10.01
D-Link/G415
earlier - 1.10.01
D-Link/G416
earlier - 1.10.01
D-Link/M18
earlier - 1.10.01
D-Link/M30
earlier - 1.10.02
D-Link/M32
earlier - 1.10.02
D-Link/M60
earlier - 1.10.02
D-Link/R03
earlier - 1.10.01
... and 5 more
Published
Jun 17, 2024
Tracked Since
Feb 18, 2026