D-Link DAP-2622 DDP Set SSID List PSK Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-37323

Summary

The D-Link DAP-2622 router is susceptible to a vulnerability that allows network-adjacent attackers to execute arbitrary code. This issue is rooted in the DDP service, which fails to properly validate the length of user-supplied data before copying it to a fixed-length stack-based buffer. As a result, malicious actors can exploit this flaw without requiring authentication, potentially gaining root access to affected devices. This vulnerability poses significant security risks to network configurations that utilize the DAP-2622 routers.

References