Attackers have started to exploit a critical-severity vulnerability impacting D-Link DIR-859 WiFi routers, which were discontinued four years ago.
The issue, tracked as CVE-2024-0769, is described as a path traversal flaw in the HTTP POST request handler component of the affected routers that can be exploited remotely without authentication to leak sensitive information.
Proof-of-concept code targeting the bug was published in January 2024, shortly after the vulnerability was disclosed publicly and D-Link acknowledged it.
Last week, GreyNoise observed the first in-the-wild attempt to exploit the security defect, using a variation of the publicly available exploit.
Unlike the PoC, which targets a file containing usernames and passwords, the in-the-wild exploit targets a different file to disclose all the sensitive information associated with all user accounts on the device.
While GreyNoise's systems caught a single exploitation attempt last week, it would not be surprising to see mass exploitation of the vulnerability soon, given that it affects all D-Link DIR-859 revisions and firmware versions.
Owners of D-Link DIR-859 routers are advised to replace them with newer, supported products.
In January, the vendor warned that these devices are no longer receiving fixes.
This Cyber News was published on www.securityweek.com. Publication date: Mon, 01 Jul 2024 12:43:05 +0000