D-Link DAP-2622 DDP Reset Factory Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20058.
History

Thu, 19 Sep 2024 08:30:00 +0000

Type Values Removed Values Added
First Time appeared D-link
D-link dap-2622
CPEs cpe:2.3:a:d-link:dap-2622:*:*:*:*:*:*:*:*
Vendors & Products D-link
D-link dap-2622
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 18 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
Description D-Link DAP-2622 DDP Reset Factory Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20058. D-Link DAP-2622 DDP Reset Factory Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20058.

cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published: 2024-05-03T01:57:49.839Z

Updated: 2024-09-18T18:28:59.392Z

Reserved: 2023-06-15T20:23:02.754Z

Link: CVE-2023-35731

cve-icon Vulnrichment

Updated: 2024-08-02T16:30:44.531Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-05-03T02:15:36.480

Modified: 2024-09-18T19:15:26.877

Link: CVE-2023-35731

cve-icon Redhat

No data.