Attackers have started to exploit a critical-severity vulnerability impacting D-Link DIR-859 WiFi routers, which were discontinued four years ago.
The issue, tracked as CVE-2024-0769 (CVSS score of 9.8), is described as a path traversal flaw in the HTTP POST request handler component of the affected routers that can be exploited remotely without authentication to leak sensitive information.
Proof-of-concept (PoC) code targeting the bug was published in January 2024, shortly after the vulnerability was disclosed publicly and D-Link acknowledged it.
Last week, GreyNoise observed the first in-the-wild attempt to exploit the security defect, using a variation of the publicly available exploit.
Unlike the PoC, which targets a file containing usernames and passwords, the in-the-wild exploit targets a different file to disclose all the sensitive information associated with all user accounts on the device.
“GreyNoise observed a slight variation in-the-wild which leverages the vulnerability to render a different PHP file to dump account names, passwords, groups, and descriptions for all users of the device,” the threat intelligence firm notes.
While GreyNoise’s systems caught a single exploitation attempt last week, it would not be surprising to see mass exploitation of the vulnerability soon, given that it affects all D-Link DIR-859 revisions and firmware versions.
Owners of D-Link DIR-859 routers are advised to replace them with newer, supported products. In January, the vendor warned that these devices are no longer receiving fixes.
“It is unclear at this time what the intended use of this disclosed information is, it should be noted that these devices will never receive a patch. Any information disclosed from the device will remain valuable to attackers for the lifetime of the device as long as it remains internet facing,” GreyNoise says.
Related: Recent Zyxel NAS Vulnerability Exploited by Botnet
Related: Recent SolarWinds Serv-U Vulnerability Exploited in the Wild
Related: CISA Warns of Exploited GeoServer, Linux Kernel, and Roundcube Vulnerabilities
Related: Fortinet Patches Code Execution Vulnerability in FortiOS
