Vulnerability DatabaseCVE-2023-1238

CVE-2023-1238:
vulnerability analysis and mitigation

Overview

A vulnerability was identified in D-Link DAP-2622 routers, tracked as CVE-2023-35732. The flaw exists within the DDP service and was discovered on January 20, 2023, with public disclosure occurring on August 25, 2023. This network-adjacent vulnerability affects D-Link DAP-2622 router installations and does not require authentication for exploitation (Zero Day Initiative).

Technical details

The vulnerability stems from improper validation of user-supplied data length before copying it to a fixed-length stack-based buffer. It has been assigned a CVSS score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating its high severity. The technical classification identifies this as a stack-based buffer overflow vulnerability (Zero Day Initiative).

Impact

Successful exploitation of this vulnerability allows attackers to execute arbitrary code in the context of root on affected D-Link DAP-2622 routers. The high CVSS score reflects the significant potential impact on system confidentiality, integrity, and availability (Zero Day Initiative).

Mitigation and workarounds

D-Link has released an update to address this vulnerability. Users can find detailed information about the security patch at the D-Link support announcement portal (Zero Day Initiative).