D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability

CVE-2023-34279

Summary

The D-Link DIR-2150 router is susceptible to a remote code execution vulnerability resulting from a command injection flaw in its SOAP API interface. This vulnerability does not require authentication, allowing network-adjacent attackers to execute arbitrary code on the router. The issue arises due to inadequate validation of user-supplied input before it is processed for execution. Attackers can exploit this weakness to gain root privileges on the affected devices, leading to potential compromise of network security and privacy. Organizations using the D-Link DIR-2150 should take immediate precautions to mitigate the risks associated with this vulnerability.

References