D-Link DAP-2622 DDP Set IPv6 Address Secondary DNS Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-37318

Summary

A vulnerability within the DDP service of D-Link DAP-2622 routers permits network-adjacent attackers to execute arbitrary code on compromised devices. This flaw arises due to inadequate validation of the length of user-supplied input before it is copied into a fixed-length stack-based buffer. Exploitation of this vulnerability requires no authentication, enabling attackers to gain root-level access and potentially control the affected devices. Users are advised to apply available updates from D-Link to mitigate this risk.

References