D-Link DIR-2640 prog.cgi Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-32149

Summary

A buffer overflow vulnerability exists within the web management interface of D-Link DIR-2640 routers, which operates on TCP port 80 by default. The vulnerability arises from inadequate validation of the length of user-supplied input before it is transferred to a limited stack-based buffer. As a result, network-adjacent attackers can exploit this flaw to execute arbitrary code with root privileges on the affected devices. The issue can be exploited without the need for authentication, increasing the risk of unauthorized access.

References