Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

D-Link routers are being hacked to steal customer passwords — but it says there is no patch

Cables going into the back of a broadband router on white background.

Threat actors are abusing a vulnerability in an outdated D-Link router to steal people’s sensitive data, researchers have claimed.

Cybersecurity experts from GreyNoise recently reported observing hackers in the wild, abusing a critical vulnerability in D-Link DIR-859 Wi-Fi routers. 

The flaw is described as a path traversal vulnerability that leads to information disclosure, and is tracked as CVE-2024-0769. It has a severity score of 9.8/10, and was first discovered in January 2024.

A fair warning

The researchers said that the threat actors are targeting the ‘DEVICE.ACCOUNT.xml’ file, in order to grab all account names, passwords, user groups, and user descriptions, found on the device. 

The worst part is that the device reached end-of-life in early 2020, meaning D-Link will not be patching this flaw. Instead, users are advised to replace the hardware with a newer component that still receives vendor support. Still, D-Link released a security advisory warning its customers of a vulnerability discovered in the ‘fatlady.php’ component of the device. In the advisory, the company explained that the flaw affects all versions of the firmware, and allows threat actors to escalate privileges and gain full control of the device through the admin panel.

The researchers subtly criticized D-Link, suggesting that publishing a security advisory without a patch is meaningless. 

"It is unclear at this time what the intended use of this disclosed information is, it should be noted that these devices will never receive a patch," the researchers said. 

"Any information disclosed from the device will remain valuable to attackers for the lifetime of the device as long as it remains internet facing.”

However, information such as this one can serve as a warning to motivate users into migrating towards a newer device, or at least to shift the responsibility of a potential data breach towards the consumer.

Via BleepingComputer

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.