D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2023-32140

7.5HIGH

Key Information:

Vendor
D-link
Status
Dap-1360
Vendor
CVE Published:
3 May 2024

Summary

A vulnerability exists in the D-Link DAP-1360 router related to the handling of requests sent to the /cgi-bin/webproc endpoint. An attacker can exploit this flaw by manipulating the 'var:sys_Token' parameter. The insufficient validation of the length of user-supplied data can lead to a heap-based buffer overflow, allowing attackers to execute arbitrary code remotely. This exploitation requires no authentication, thus posing significant risks to network security and the integrity of the affected devices. Addressing this vulnerability is crucial for maintaining secure network environments.

Affected Version(s)

DAP-1360 6.14B01 EU HOTFIX

References

https://www.zerodayinitiative.com/advisories/ZDI-23-532/
x_research-advisory
https://supportannouncement.us.dlink.com/announcement/pub...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.