D-Link DIR-3040 prog.cgi SetWanSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-41219

Summary

A buffer overflow vulnerability in the prog.cgi binary of the D-Link DIR-3040 router allows network-adjacent attackers to execute arbitrary code. This vulnerability arises from inadequate validation of a user-supplied string, leading to a stack-based overflow condition. The flaw affects the handling of HNAP requests via the lighttpd webserver running on standard TCP ports 80 and 443. Since authentication is required, exploitation necessitates access with valid credentials. However, once compromised, the attacker can execute code in the context of the root user, thereby gaining extensive control over the device. Mitigation steps should be taken immediately to secure affected installations.

References