D-Link DAP-2622 DDP Set Date-Time Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-41215

Summary

The D-Link DAP-2622 router is affected by a stack-based buffer overflow vulnerability within its DDP service. This flaw stems from insufficient validation of user-supplied data length before copying it to a fixed-length stack-based buffer. As a result, network-adjacent attackers can exploit this vulnerability to execute arbitrary code with root privileges on the device. Notably, exploitation does not require authentication, which increases the risk to affected installations significantly. Users and administrators of impacted D-Link DAP-2622 routers are urged to apply the necessary updates and follow the vendor-provided guidance to mitigate potential risks.

References