Stack-based Buffer Overflow Remote Code Execution Vulnerability in D-Link DAP-1325 Routers

CVE-2023-44408

What is CVE-2023-44408?

The D-Link DAP-1325 is affected by a significant vulnerability that arises from inadequate validation of XML data length provided to the HNAP1 SOAP endpoint. This flaw facilitates potential exploitation by allowing network-adjacent attackers to execute arbitrary code on vulnerable installations without the need for authentication. The vulnerability occurs due to a stack-based buffer overflow stemming from the failure to properly restrict the length of user-supplied input, thereby providing attackers an opportunity to run code with root privileges.

References