D-Link DAP-2622 DDP Set Device Info Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-37310

What is CVE-2023-37310?

A stack-based buffer overflow vulnerability exists within the DDP service of D-Link DAP-2622 routers, enabling network-adjacent attackers to execute arbitrary code without requiring authentication. The flaw arises due to insufficient validation of the length of user-supplied data before it is copied into a fixed-length buffer on the stack. This oversight can be exploited to gain root-level access, potentially compromising the integrity and security of affected installations. For more detailed information, refer to the advisory from the Zero Day Initiative and the vendor-provided security announcement.

References