D-Link DAP-2622 DDP Set Wireless Info Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-37324

Summary

The D-Link DAP-2622 router is impacted by a stack-based buffer overflow vulnerability tied to the DDP (D-Link Discovery Protocol) service. This flaw allows network-adjacent attackers to exploit the vulnerability without the need for any form of authentication. The fundamental issue arises from insufficient validation of incoming user data, which can be copied to a fixed-length stack-based buffer. Successful exploitation of this vulnerability enables attackers to execute arbitrary code with root privileges, posing significant risks to the security and integrity of network management and connected devices.

References