D-Link DAP-1325 SetAPLanSettings SecondaryDNS Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-41204

Summary

The D-Link DAP-1325 router contains a security vulnerability that allows network-adjacent attackers to execute arbitrary code on vulnerable installations. This flaw is due to inadequate validation of the length of user-supplied XML data when processed by the HNAP1 SOAP endpoint. An attacker can exploit this vulnerability without the need for authentication, enabling execution of malicious code in the context of the root user, potentially compromising the integrity and security of the device. This issue highlights the importance of robust input validation and security measures in network devices.

References