D-Link DAP-2622 DDP Set SSID List RADIUS Server Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-37322

Summary

A stack-based buffer overflow vulnerability exists in the DDP service of D-Link DAP-2622 routers. This vulnerability arises due to insufficient validation of the length of user-supplied data before it is copied to a fixed-length stack-based buffer. Attackers who are adjacent to the network can exploit this flaw to execute arbitrary code in the context of the root user, leading to unauthorized access and control over the affected routers. Importantly, authentication is not required for exploitation, raising significant security concerns about these devices.

References