D-Link DAP-1325 SetHostIPv6StaticSettings StaticPrefixLength Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-41211

Summary

A vulnerability associated with the D-Link DAP-1325 routers allows network-adjacent attackers to execute arbitrary code. The flaw resides in the handling of XML data at the HNAP1 SOAP endpoint, where insufficient validation of user-supplied data length leads to a stack-based buffer overflow. This vulnerability permits attackers to execute code in the context of root without requiring any authentication, exposing devices to significant risk. For further details, see the vendor advisory from D-Link and the Zero Day Initiative's advisory for additional context.

References