CVE-2024-11067

Relative Path Traversal (CWE-23)

Published: Nov 11, 2024 / Updated: 8d ago

D-Link has issued an urgent advisory for users of its DSR-150, DSR-150N, DSR-250, and DSR-250N VPN routers, citing a critical stack buffer overflow vulnerability that could allow remote code execution by unauthenticated attackers. These devices, which have reached their End-of-Life (EoL) and End-of-Service (EoS) status as of May 2024, no longer receive firmware updates or security patches, leaving users exposed to significant cyber risks.

D-Link is warning customers to replace end-of-life VPN router models after a critical unauthenticated, remote code execution vulnerability was discovered that will not be fixed on these devices. Products that have reached their EOL/EOS no longer receive device software updates and security patches and are no longer supported by D-Link US." - D-Link

D-Link is warning customers to replace end-of-life VPN router models after a critical unauthenticated, remote code execution vulnerability was discovered that will not be fixed on these devices. Products that have reached their EOL/EOS no longer receive device software updates and security patches and are no longer supported by D-Link US." - D-Link

The flaw, which does not have a CVE assigned yet, was discovered and reported by a security researcher known as ‘delsploit.’ The researcher has refrained from releasing technical details to the public to prevent widespread exploitation attempts. D-Link, the networking hardware vendor, has alerted its customers about a critical unauthenticated, remote code execution vulnerability affecting certain end-of-life VPN router models.