Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-44407

Summary

A stack-based buffer overflow vulnerability exists in the D-Link DAP-1325 router's handling of XML data sent to the HNAP1 SOAP endpoint. This issue arises from inadequate validation of user-supplied data length before copying it into a fixed-length stack-based buffer. Attackers on the same network can exploit this flaw to execute arbitrary code with root-level permissions, potentially compromising the router's security and performance. Given that authentication is not required for exploitation, this makes the vulnerability particularly concerning for users of affected products. Remediation steps should be taken promptly to mitigate potential risks.

References