D-Link DAP-1360 webproc Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-32139

Summary

The D-Link DAP-1360 routers are affected by a stack-based buffer overflow vulnerability which can be exploited by network-adjacent attackers to execute arbitrary code. This flaw occurs due to insufficient validation of user-supplied data length at the /cgi-bin/webproc endpoint prior to copying it to a fixed-length stack-based buffer. Consequently, an attacker can leverage this vulnerability to execute code with root privileges, potentially compromising the integrity and confidentiality of the device and the network it is connected to. This vulnerability does not require authentication, making it particularly concerning for users of the affected product.

References