Arbitrary Code Execution Vulnerability in D-Link DIR-3040 Routers
CVE-2022-43648

8.8HIGH

Key Information:

Vendor

D-link
Status
Dir-3040
Vendor
CVE Published:
29 March 2023

What is CVE-2022-43648?

A vulnerability in D-Link DIR-3040 routers enables attackers on the same network to execute arbitrary code without authentication. This issue stems from inadequate validation of user-supplied data length within the MiniDLNA service. By exploiting this flaw, an attacker can manipulate the heap-based buffer, potentially compromising the integrity of the router's functionality and allowing further malicious actions.

Affected Version(s)

DIR-3040 1.20B03

References

https://www.zerodayinitiative.com/advisories/ZDI-23-052/
https://supportannouncement.us.dlink.com/announcement/pub...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nicholas Zubrisky
.