D-Link VPN routers, widely used in home and small business environments, have reached their End of Life (EoL) and are vulnerable to a critical Remote Code Execution (RCE) vulnerability, remaining exposed with no security updates available.
| Product | D-Link |
| Date | 2024-11-22 17:26:55 |
| Information |
|
Technical Summary
A critical unauthenticated Remote Code Execution (RCE) vulnerability, discovered by researcher delsploit, affects the following D-Link routers:
- DSR-150
- DSR-150N
- DSR-250
- DSR-250N
The vulnerability affects all hardware versions and all firmware revisions between 3.13 and 3.17B901C, allowing attackers to execute arbitrary code remotely without the need for authentication. D-Link has confirmed that no security updates will be released due to the EoL status of the devices, and even the latest firmware versions do not mitigate the risk. Continued use of these devices poses a critical threat to connected networks and systems.
Recommendations
- Replace vulnerable devices: Immediately replace the affected routers with supported and actively maintained alternatives.
- Isolate devices: If immediate replacement is not possible, isolate these routers from critical systems to reduce potential exposure.
Protect your organisation with Threat Intelligence and Digital Risk Protection.
Choose ISGroup for a practical, tailored engagement:
- A focused assessment of your environment and requirements
- Clear findings with a prioritised, actionable roadmap
- Direct support from experienced specialists through remediation and implementation