D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticPrefixLength Command Injection Remote Code Execution Vulnerability

CVE-2023-41200

Summary

The D-Link DAP-1325 router exhibits a command injection vulnerability through its HNAP1 SOAP interface, which allows network-adjacent attackers to execute arbitrary code. This flaw arises from insufficient validation on user-input parameters, particularly within the SetHostIPv6StaticSettings command. By manipulating the request parameter, an attacker can perform system calls in the context of the device's root privileges without the need for authentication. This vulnerability raises significant concerns for users, highlighting the need for timely updates and security measures to prevent unauthorized system access.

References