D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-32136

Summary

A stack-based buffer overflow vulnerability has been identified in D-Link DAP-1360 routers, specifically related to the handling of the var:menu parameter at the /cgi-bin/webproc endpoint. This issue arises from inadequate validation of the input length, allowing attackers with network access to supply malicious data. When exploited, this vulnerability can lead to arbitrary code execution in the context of the root user, posing a significant security risk to affected devices. As no authentication is required to perform this attack, users are strongly advised to implement necessary security measures and monitor their networks for potential exploitation.

References