D-Link DAP-1360 webproc WEB_DisplayPage Directory Traversal Information Disclosure Vulnerability

CVE-2023-32137

Summary

The D-Link DAP-1360 router is susceptible to an information disclosure vulnerability that arises from improper processing of requests directed at the /cgi-bin/webproc endpoint. This flaw results from the absence of adequate validation of user-supplied path inputs, enabling an attacker with network access to exploit this issue without any authentication. By leveraging this vulnerability, attackers can gain unauthorized access to sensitive information stored on the device, potentially disclosing data in the context of root. It poses a significant risk to the confidentiality of information within affected installations.

References