D-Link DAP-1360 webproc var:sys_Token Heap-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-32140

What is CVE-2023-32140?

A vulnerability exists in the D-Link DAP-1360 router related to the handling of requests sent to the /cgi-bin/webproc endpoint. An attacker can exploit this flaw by manipulating the 'var:sys_Token' parameter. The insufficient validation of the length of user-supplied data can lead to a heap-based buffer overflow, allowing attackers to execute arbitrary code remotely. This exploitation requires no authentication, thus posing significant risks to network security and the integrity of the affected devices. Addressing this vulnerability is crucial for maintaining secure network environments.

References