D-Link DAP-1325 SetAPLanSettings Mode Stack-based Buffer Overflow Remote Code Execution Vulnerability
CVE-2023-41202

8.8HIGH

Key Information:

Vendor
D-link
Status
Dap-1325
Vendor
CVE Published:
3 May 2024

Summary

A stack-based buffer overflow vulnerability exists in the D-Link DAP-1325 router, specifically within the HNAP1 SOAP endpoint's handling of XML data. This flaw arises due to the failure to validate the length of user-supplied data before it is copied to a fixed-length stack-based buffer. As a result, network-adjacent attackers can exploit this vulnerability to execute arbitrary code on affected devices without the need for authentication. Proper security measures and updates are essential to mitigate the risk associated with this vulnerability.

Affected Version(s)

DAP-1325 1.07b01

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1310/
x_research-advisory
https://supportannouncement.us.dlink.com/announcement/pub...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.