D-Link DIR-2150 SetNTPServerSettings Command Injection Remote Code Execution Vulnerability

CVE-2023-34275

Summary

The vulnerability present in D-Link DIR-2150 routers permits network-adjacent attackers to execute arbitrary code through a command injection flaw in the SOAP API interface. This critical issue arises from insufficient validation of user-supplied strings prior to executing system calls. While the vulnerability requires authentication for exploitation, an attacker can bypass the existing authentication mechanisms. By leveraging this vulnerability, an attacker can gain root-level access to the affected system, undermining the security integrity of the device and potentially leading to further exploitation within the network.

References