2 days Ago
A critical vulnerability, allowing for remote code execution (RCE) attacks, has been discovered on multiple D-Link . However, since the models have now reached end-of-life, D-Link will not be issuing a patch - and instead, it urged users to retire the affected devices and replace them with newer, supported models. The flaw does not have a CVE designation just yet, but the company, as well as the researcher who found the flaw - alias ‘desploit’ - will not be releasing any details about it, to give affected customers enough time to react.
In any case, once word gets out, cybercriminals will definitely start scanning for vulnerable routers, so if you’re using one of these models, make sure to replace them as soon as possible: DSR-150 DSR-150N DSR-250 DSR-250N No workarounds D-Link said that both hardware and firmware for these devices have expired, and workarounds are not recommended: "The DSR-150 / DSR-150N / DSR-250 / DSR-250N all hardware versions and firmware versions have been EOL/EOS as of 05/01/2024. This exploit affects this legacy D-Link router and all hardware revisions, which have reached their End of Life [..
.]. Products that have reached their EOL/EOS no longer receive device software updates and security patches and are no longer supported by D-Link US,” D-Link said in a recent security advisory.
"D-Link strongly recommends that this product be retired.” Routers, being the gateways of all internet traffic on a local network, are usually the first thing criminals will try to compromise in their attacks. End-of-life devices with known critical vulnerabilities, especially RCE, are considered low hanging fruit.
Furthermore, the affected device versions are often used in homes and small businesses, according to a recent report. That makes them an ideal target for deployment, distributed denial of service botnets, and possibly even ransomware attacks..
