D-Link DAP-2622 DDP Set Date-Time Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-35756

Summary

A vulnerability affecting the D-Link DAP-2622 routers has been identified, allowing remote code execution through a stack-based buffer overflow. This issue arises from improper validation of user-supplied data length within the DDP service, which leads to the potential for attackers to manipulate the system. Exploitation of this vulnerability does not require authentication, enabling network-adjacent attackers to execute arbitrary code with root privileges, thereby compromising the integrity of affected installations.

References