D-Link DAP-1360 webproc Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-32138

Summary

A buffer overflow vulnerability exists in D-Link DAP-1360 routers, specifically within the handling of requests directed to the /cgi-bin/webproc endpoint. This flaw stems from improper validation of the length of user-supplied data before it is copied into a fixed-length heap-based buffer. An attacker situated on the same network can exploit this vulnerability to execute arbitrary code with root privileges, potentially compromising device integrity and security. Exploitation is possible without requiring authentication, making it particularly concerning for users of affected models.

References