“Roughly 60,000 vulnerable devices are currently connected to the internet, the majority being located in Taiwan.”
The DSL6740C has a 9.8 bug that lets attackers change passwords through the API, plus RCE, path traversal and four command injection flaws. D-Link’s fix is to buy a new one, the same answer it gave days earlier for NAS boxes with a 9.2 flaw. The modem reached end of life less than a year ago. D-Link keeps the sale and the owners keep the botnet.