CVE-2024-33113 is a vulnerability in the D-LINK DIR-845L router that allows information disclosure
1Vulnerability: CVE-2024-33113 (Information Disclosure)
Affected Device: D-LINK DIR-845L router (versions (bellow or =) v1.01KRb03)
Cause: Improper handling of the include() function in the bsc_sms_inbox.php file. Attackers can manipulate the $file variable to include unauthorized PHP scripts.
Impact: Attackers can potentially steal sensitive information from the router, including usernames and passwords. This could give them complete control over your network and the devices connected to it.
Recommendations:
Update your firmware: D-Link has likely released a firmware update that patches this vulnerability. Check their website for the latest firmware for your specific router model and update it immediately.
Change router password: Even if you update the firmware, it's a good practice to change your router's password to something strong and unique.
Here are some additional points to consider:
Public exploit code (Proof of Concept - PoC) might be available, making it easier for attackers to exploit this vulnerability.
This vulnerability allows remote attacks, so you don't need physical access to the router to exploit it.
If you're not comfortable updating the firmware yourself, consider seeking help from a network technician. Taking these steps will help protect your network from potential attacks.