Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-44404

Summary

A stack-based buffer overflow vulnerability exists in the D-Link DAP-1325 routers, allowing network-adjacent attackers to execute arbitrary code. The flaw arises from improper validation of user-supplied XML data length sent to the HNAP1 SOAP endpoint. Due to this lack of validation, an attacker can exploit the vulnerability without the need for authentication, potentially executing code with root privileges, thereby compromising the affected device. This vulnerability highlights the importance of secure data handling practices in network-connected devices.

References