D-Link DAP-2622 DDP Set IPv6 Address Secondary DNS Stack-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2023-37318
8.8HIGH
What is CVE-2023-37318?
A vulnerability within the DDP service of D-Link DAP-2622 routers permits network-adjacent attackers to execute arbitrary code on compromised devices. This flaw arises due to inadequate validation of the length of user-supplied input before it is copied into a fixed-length stack-based buffer. Exploitation of this vulnerability requires no authentication, enabling attackers to gain root-level access and potentially control the affected devices. Users are advised to apply available updates from D-Link to mitigate this risk.
Affected Version(s)
DAP-2622 1.00 dated 16-12-2020