D-Link DAP-2622 DDP Set IPv6 Address Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20092.
History

Thu, 19 Sep 2024 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Dlink
Dlink dap 2622 Firmware
CPEs cpe:2.3:o:dlink:dap_2622_firmware:*:*:*:*:*:*:*:*
Vendors & Products Dlink
Dlink dap 2622 Firmware
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 18 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
Description D-Link DAP-2622 DDP Set IPv6 Address Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20092. D-Link DAP-2622 DDP Set IPv6 Address Auth Username Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DDP service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-20092.

cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published: 2024-05-03T01:58:10.952Z

Updated: 2024-09-18T18:29:20.764Z

Reserved: 2023-06-30T17:27:13.596Z

Link: CVE-2023-37314

cve-icon Vulnrichment

Updated: 2024-08-02T17:09:34.195Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-05-03T02:15:41.233

Modified: 2024-09-18T19:15:29.750

Link: CVE-2023-37314

cve-icon Redhat

No data.