D-Link DAP-1325 HNAP SetSetupWizardStatus Enabled Command Injection Remote Code Execution Vulnerability
CVE-2023-41201

8.8HIGH

Key Information:

Vendor
D-link
Status
Dap-1325
Vendor
CVE Published:
3 May 2024

Summary

A security flaw in D-Link DAP-1325 routers enables remote code execution via the HNAP SetSetupWizardStatus command injection. The vulnerability allows network-adjacent attackers to execute arbitrary code without authentication, exploiting insufficient input validation in the handling of request parameters sent to the HNAP1 SOAP endpoint. This weakness could allow unauthorized individuals to run commands with root privileges, posing significant risks to network security. Users are advised to address this vulnerability to mitigate potential threats and protect sensitive systems.

Affected Version(s)

DAP-1325 1.07b01

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1309/
x_research-advisory
https://supportannouncement.us.dlink.com/announcement/pub...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.