CVE-2024-57045

CVE-2024-57045 is an improper-authentication flaw (CWE-287) in D-Link DIR-859 routers running firmware A3 1.05 or earlier that lets an unauthenticated attacker bypass access controls. It is triggered by sending a forged POST request to the router's /getcfg.php page, which returns the device's username and password without any prior authentication or user interaction. An attacker who recovers these credentials gains access to the router's management interface and, from there, potentially to the network it controls. Any DIR-859 (A3 hardware revision) running affected firmware is exposed, with risk greatest for devices whose web interface is reachable from the internet or from untrusted LAN clients. No confirmed in-the-wild exploitation is recorded (not in CISA KEV), but a public proof-of-concept exists and EPSS estimates roughly a 32% probability of exploitation within 30 days, so defenders should treat it as likely to be exploited.

What to do: Inventory networks for DIR-859 (A3) routers on firmware A3 1.05 or earlier and check D-Link's support portal for updated firmware, as no fixed version is provided in the disclosure data. Until patched, restrict the web management interface to trusted LAN segments (disable remote/WAN-side management) and limit untrusted LAN clients, since any client that can reach /getcfg.php can retrieve the credentials. Rotate the administrator username and password after patching or mitigating, and consider replacing the device if it is end-of-life and no firmware fix is released.