Stack-based Buffer Overflow Remote Code Execution Vulnerability in D-Link DAP-2622 Routers

CVE-2023-35748

Summary

A vulnerability has been identified in the D-Link DAP-2622 routers that permits network-adjacent attackers to execute arbitrary code on the device. This issue stems from inadequate validation of user-supplied data length before it's copied into a fixed-length buffer within the DDP service. As a result, an attacker can exploit this flaw without any authentication, gaining root access and potentially executing harmful operations on the compromised router. This poses significant risks to the security and integrity of network environments utilizing affected devices.

References